rustio_admin/middleware/
csrf.rs

1//! CSRF protection using the double-submit cookie pattern.
2//!
3//! How it works:
4//! 1. First response from a "safe" method (GET/HEAD/OPTIONS) sets a
5//!    `rustio_csrf` cookie if one isn't already present. The value is
6//!    a 32-byte random token, URL-safe-base64 encoded.
7//! 2. Every "unsafe" request (POST/PUT/DELETE/PATCH) must carry the
8//!    same token in either a header (`X-CSRF-Token`) or a form field
9//!    (`_csrf`), matching the cookie.
10//! 3. Mismatch → 403.
11//!
12//! This is the standard Django/Rails pattern. It's simple, stateless,
13//! and works with HTML forms and JS clients alike.
14
15use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
16use hyper::Method;
17use rand::RngCore;
18use subtle::ConstantTimeEq;
19
20use crate::error::{Error, Result};
21use crate::http::{Request, Response};
22use crate::router::Next;
23
24// public:
25pub const CSRF_COOKIE: &str = "rustio_csrf";
26// public:
27pub const CSRF_HEADER: &str = "x-csrf-token";
28// public:
29pub const CSRF_FIELD: &str = "_csrf";
30
31// public:
32/// A value a handler can pull out of the request context to embed in a
33/// rendered form. Lightweight; just wraps a string.
34#[derive(Debug, Clone)]
35pub struct CsrfGuard {
36    pub token: String,
37}
38
39// public:
40pub async fn csrf_protect(mut req: Request, next: Next) -> Result<Response> {
41    let existing_token = cookie_value(&req, CSRF_COOKIE);
42    let needs_cookie = existing_token.is_none();
43    let token = existing_token.unwrap_or_else(random_token);
44
45    // Give the handler access to the current token via context, so
46    // templates can render a hidden input without re-reading the cookie.
47    req.ctx_mut().insert(CsrfGuard {
48        token: token.clone(),
49    });
50
51    // On unsafe methods: compare header-or-form against cookie.
52    if !is_safe(req.method()) {
53        let provided = req.header(CSRF_HEADER).map(|s| s.to_string()).or_else(|| {
54            req.form()
55                .ok()
56                .and_then(|f| f.get(CSRF_FIELD).map(|v| v.to_string()))
57        });
58        let provided = match provided {
59            Some(p) => p,
60            None => return Err(Error::Forbidden("CSRF token missing".into())),
61        };
62        if !constant_time_eq(&provided, &token) {
63            return Err(Error::Forbidden("CSRF token mismatch".into()));
64        }
65    }
66
67    let mut resp = next.run(req).await?;
68    if needs_cookie {
69        let cookie = format!("{CSRF_COOKIE}={token}; Path=/; SameSite=Strict; Max-Age=86400");
70        resp.headers.push(("set-cookie".into(), cookie));
71    }
72    Ok(resp)
73}
74
75fn is_safe(method: &Method) -> bool {
76    matches!(*method, Method::GET | Method::HEAD | Method::OPTIONS)
77}
78
79fn cookie_value(req: &Request, name: &str) -> Option<String> {
80    let header = req.header("cookie")?;
81    let prefix = format!("{name}=");
82    for part in header.split(';') {
83        let part = part.trim();
84        if let Some(v) = part.strip_prefix(&prefix) {
85            return Some(v.to_string());
86        }
87    }
88    None
89}
90
91fn random_token() -> String {
92    let mut bytes = [0u8; 32];
93    rand::thread_rng().fill_bytes(&mut bytes);
94    URL_SAFE_NO_PAD.encode(bytes)
95}
96
97fn constant_time_eq(a: &str, b: &str) -> bool {
98    a.as_bytes().ct_eq(b.as_bytes()).into()
99}
100
101#[cfg(test)]
102mod tests {
103    use super::*;
104
105    #[test]
106    fn is_safe_recognises_read_methods() {
107        assert!(is_safe(&Method::GET));
108        assert!(is_safe(&Method::HEAD));
109        assert!(is_safe(&Method::OPTIONS));
110        assert!(!is_safe(&Method::POST));
111        assert!(!is_safe(&Method::DELETE));
112    }
113
114    #[test]
115    fn constant_time_eq_basic() {
116        assert!(constant_time_eq("abc", "abc"));
117        assert!(!constant_time_eq("abc", "abd"));
118        assert!(!constant_time_eq("abc", "ab"));
119    }
120}
rustio_admin/middleware/csrf.rs

rustio_admin/middleware/
csrf.rs
