maw 0.30.0

A simple and efficient web framework for Rust.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157

use http::{Method, StatusCode};

use crate::{
    ctx::Ctx,
    handler::Handler,
    middlewares::cookie::{CookieOptions, CookieType},
};

const CSRF_HEADER: &str = "X-CSRF-Token";

#[derive(Clone, Copy, Debug)]
pub enum CsrfStorage {
    Cookie,
    #[cfg(feature = "middleware-session")]
    Session,
}

/// Has to be added after the CookieMiddleware or SessionMiddleware
#[derive(Clone, Debug)]
pub struct CsrfMiddleware {
    storage: CsrfStorage,
    key_name: String,
    safe_methods: Vec<Method>,
    cookie_type: CookieType,
    cookie_options: CookieOptions,
}

impl Default for CsrfMiddleware {
    fn default() -> Self {
        Self {
            storage: CsrfStorage::Cookie,
            key_name: "csrf_token".to_string(),
            safe_methods: vec![Method::GET, Method::HEAD, Method::OPTIONS, Method::TRACE],
            cookie_type: CookieType::Signed,
            cookie_options: CookieOptions::new()
                .path("/")
                .http_only(true)
                .same_site(crate::middlewares::cookie::SameSite::Strict),
        }
    }
}

impl CsrfMiddleware {
    pub fn new() -> Self {
        Self::default()
    }

    pub fn storage(mut self, storage: CsrfStorage) -> Self {
        self.storage = storage;
        self
    }

    pub fn key_name(mut self, name: impl Into<String>) -> Self {
        self.key_name = name.into();
        self
    }

    pub fn safe_methods(mut self, methods: Vec<Method>) -> Self {
        self.safe_methods = methods;
        self
    }

    pub fn cookie_type(mut self, cookie_type: CookieType) -> Self {
        assert!(
            !matches!(cookie_type, CookieType::Plain),
            "Session cookie type cannot be Plain for security reasons"
        );
        self.cookie_type = cookie_type;
        self
    }

    pub fn cookie_options(mut self, options: CookieOptions) -> Self {
        self.cookie_options = options;
        self
    }
}

fn generate_token() -> String {
    use rand::Rng;
    let mut bytes = [0u8; 32];
    rand::rng().fill_bytes(&mut bytes);
    let mut result = String::with_capacity(64);
    for byte in bytes {
        result.push_str(&format!("{:02x}", byte));
    }
    result
}

impl Ctx {
    /// Get the CSRF token for this request
    pub fn csrf_token(&self) -> &str {
        self.req
            .locals
            .get::<&str>("csrf_token")
            .map(|s| *s)
            .unwrap_or("")
    }

    /// Get the name of the CSRF header
    pub fn csrf_header() -> &'static str {
        CSRF_HEADER
    }
}

impl Handler<&mut Ctx> for CsrfMiddleware {
    type Output = ();

    fn on_app_listen_mut(&self, app: &mut crate::prelude::App) {
        app.jinja
            .with(|env| env.add_global("csrf_header", CSRF_HEADER));
    }

    async fn call(&self, c: &mut Ctx) -> Self::Output {
        let is_safe = self.safe_methods.contains(c.req.method());

        let token = match self.storage {
            CsrfStorage::Cookie => c
                .cookies
                .get_typed::<String>(&self.key_name, &self.cookie_type)
                .unwrap_or_else(|_| {
                    let token = generate_token();
                    c.cookies.set_typed(
                        &self.key_name,
                        &token,
                        &self.cookie_type,
                        Some(self.cookie_options.clone()),
                    );
                    token
                }),
            #[cfg(feature = "middleware-session")]
            CsrfStorage::Session => c.session.get::<String>(&self.key_name).unwrap_or_else(|_| {
                let token = generate_token();
                c.session.set(&self.key_name, token.clone());
                token
            }),
        };

        if !is_safe {
            let submitted_token = c.req.header(CSRF_HEADER);
            let is_valid = submitted_token
                .as_ref()
                .map(|submitted| {
                    constant_time_eq::constant_time_eq(submitted.as_bytes(), token.as_bytes())
                })
                .unwrap_or(false);

            if !is_valid {
                c.res.send_status(StatusCode::FORBIDDEN);
                return;
            }
        }

        c.req.locals.insert("csrf_token", token);

        c.next().await;
    }
}