Next.js Discord

Discord Forum

Implement CSRF from next/auth

Unanswered
Little fire ant posted this in #help-forum
Open in Discord
Little fire antOP
Hello I'm trying to protect some POST Request API Routes in the next api router and I was how can I implement this for example when the user logs in it protects all the routes of POST Requests.

24 Replies

Little fire antOP
I'm currently using next auth for authentication
@alfon You can use getServerSession in api routes to check if user is authed or not.
Little fire antOP
so I don't need a csrf token?
on my POST Requests?
const handler = async (req: NextApiRequest, res: NextApiResponse) => {
    /* Check if the method is valid */
    if (req.method !== 'POST') {
        return res.status(405).json({message: 'Method not allowed.'});
    }

    /* Check if user is authenticated */
    const session = await getServerSession(req, res, authOptions)

    if(!session) {
        return res.status(405).json({message: 'Unauthorized.'});
    }

    return res.status(200).json({message: "This API route is protected. Hello from LynixAPI!"})
}

export default handler;
This is what i'm doing rn
tafutada777
@Little fire ant seems like you are not clear the difference between CSRF and Authorization. As for CSRF, there does not seem to be idiomatic way in Next.js
tafutada777
i just googled for CSRF but to no avail
Little fire antOP
Same
I searched far and wide but I require it for my app's security
tafutada777
just reverse-engineer some of CSRF libs in npm
Little fire antOP
I'm suprised no one did this before?
tafutada777
basically just generate a nonce would be enough as long as its small project
Little fire antOP
it's a medium sized project
one thing is if its open source, hacker can easialy reverse-engineer the code and find security hole.
so to bolster ur security, implementation should not be disclosed, and original.
that's how smart contracts of web3 hacked.
ChatGPT does that, haha.
tafutada777
i remember CSRF token is not needed for major web browsers, as Auth.js session token is samesite=lax, so the session cookie won't be sent via CSR.
Does this really mean “goodbye” to CSRF? Yes, it looks like the SameSite cookie attribute is an effective security measure against CSRF attacks. You can avoid sending your cookies with the request initiated by third parties by using this feature. Let me clarify with an example:
https://www.invicti.com/blog/web-security/same-site-cookie-attribute-prevent-cross-site-request-forgery/
Little fire antOP
I was talking about routes that does changes to content
Using Post
Barbary Lion
hey @Little fire ant, did you figure out how CSRF token can be used along side with Auth.js? or u just ignored it and continued to rely on session id with sameSite attribute