Updates

users/user-auth.d.ts

@@ -16,10 +16,12 @@ export = userAuth;
  * @param {string} [params.database] - Database Name (slug)
  * @param {string | number} [params.dsqlUserId] - alt env: DSQL_API_USER_ID
  * @param {number} [params.expiry] - Expiry time in milliseconds
+ * @param {string} [params.csrfHeaderName] - Optional. CSRF Header Name
+ * @param {boolean} [params.csrfHeaderIsValue] - If the csrf value is the name of the request http header
  *
  * @returns { import("../package-shared/types").AuthenticatedUser }
  */
-declare function userAuth({ request, req, encryptionKey, encryptionSalt, level, database, dsqlUserId, encryptedUserString, expiry, cookieString, }: {
+declare function userAuth({ request, req, encryptionKey, encryptionSalt, level, database, dsqlUserId, encryptedUserString, expiry, cookieString, csrfHeaderIsValue, csrfHeaderName, }: {
     request?: http.IncomingMessage & {
         [x: string]: any;
     };
@@ -34,5 +36,7 @@ declare function userAuth({ request, req, encryptionKey, encryptionSalt, level,
     database?: string;
     dsqlUserId?: string | number;
     expiry?: number;
+    csrfHeaderName?: string;
+    csrfHeaderIsValue?: boolean;
 }): import("../package-shared/types").AuthenticatedUser;
 import http = require("http");

users/user-auth.js

@@ -32,6 +32,8 @@ const yearInMilliseconds = dayInMilliseconds * 365;
  * @param {string} [params.database] - Database Name (slug)
  * @param {string | number} [params.dsqlUserId] - alt env: DSQL_API_USER_ID
  * @param {number} [params.expiry] - Expiry time in milliseconds
+ * @param {string} [params.csrfHeaderName] - Optional. CSRF Header Name
+ * @param {boolean} [params.csrfHeaderIsValue] - If the csrf value is the name of the request http header
  *
  * @returns { import("../package-shared/types").AuthenticatedUser }
  */
@@ -46,6 +48,8 @@ function userAuth({
     encryptedUserString,
     expiry = weekInMilliseconds,
     cookieString,
+    csrfHeaderIsValue,
+    csrfHeaderName,
 }) {
     try {
         const finalEncryptionKey =
@@ -127,12 +131,17 @@ function userAuth({
          */
         if (
             level?.match(/deep/i) &&
-            !csrf?.match(new RegExp(`${userObject.csrf_k}`))
+            ((csrfHeaderName &&
+                req?.headers[csrfHeaderName] !== userObject.csrf_k &&
+                request?.headers[csrfHeaderName] !== userObject.csrf_k) ||
+                (csrfHeaderIsValue &&
+                    !req?.headers[userObject.csrf_k] &&
+                    !request?.headers[userObject.csrf_k]))
         ) {
             return {
                 success: false,
                 payload: null,
-                msg: "CSRF_K requested but does not match payload",
+                msg: "CSRF_K mismatch",
             };
         }