tokens and more

src/app/mod.rs

@@ -10,11 +10,12 @@
 mod pages;
 
 use axum::{
+    Json,
     Router,
     extract::{DefaultBodyLimit, Request},
-    http::{HeaderName, HeaderValue, StatusCode, header},
+    http::{HeaderName, HeaderValue, Method, StatusCode, header},
     middleware::{self, Next},
-    response::Response,
+    response::{IntoResponse, Response},
     routing::{get, post},
 };
 use pages::*;
@@ -75,6 +76,7 @@ pub fn router(
             get(api::download_legacy_file),
         )
         .route("/api/auth/identity", post(auth::identity))
+        .route("/api/security/csrf", get(crate::security::csrf_token_endpoint))
         .route("/api/access-token", post(api::create_resource_access_token))
         .route("/api/auth/register", post(auth::register))
         .route("/api/auth/login", post(auth::login))
@@ -221,10 +223,29 @@ pub fn router(
             HeaderValue::from_static("same-origin"),
         ))
         .layer(TraceLayer::new_for_http())
+        .layer(middleware::from_fn(require_csrf_token))
         .layer(middleware::from_fn(add_non_asset_security_headers))
         .with_state(state)
 }
 
+async fn require_csrf_token(request: Request, next: Next) -> Response {
+    let method = request.method();
+    let unsafe_method = method == Method::POST
+        || method == Method::PUT
+        || method == Method::PATCH
+        || method == Method::DELETE;
+    if unsafe_method && !crate::security::csrf_request_is_valid(request.headers()) {
+        return (
+            StatusCode::FORBIDDEN,
+            Json(serde_json::json!({
+                "error": "Security token is missing or expired. Refresh the page and try again."
+            })),
+        )
+            .into_response();
+    }
+    next.run(request).await
+}
+
 async fn add_non_asset_security_headers(request: Request, next: Next) -> Response {
     let path = request.uri().path();
     let is_asset = path.starts_with("/assets/");