refactor: replace csurf with csrf-csrf

package.json

@@ -74,7 +74,7 @@
     "codemirror": "5.65.18",
     "compression": "1.7.5",
     "cookie-parser": "1.4.7",
-    "csurf": "1.2.2",
+    "csrf-csrf": "3.1.0",
     "dayjs": "1.11.13",
     "dayjs-plugin-utc": "0.1.2",
     "debounce": "2.2.0",
@@ -160,7 +160,6 @@
     "@types/cls-hooked": "4.3.9",
     "@types/compression": "1.7.5",
     "@types/cookie-parser": "1.4.8",
-    "@types/csurf": "1.11.5",
     "@types/debounce": "1.2.4",
     "@types/ejs": "3.1.5",
     "@types/electron-squirrel-startup": "1.0.2",

src/routes/index.ts

@@ -19,7 +19,7 @@ function index(req: Request, res: Response) {
 
     const view = !utils.isElectron() && req.cookies["trilium-device"] === "mobile" ? "mobile" : "desktop";
 
-    const csrfToken = req.csrfToken();
+    const csrfToken = (typeof req.csrfToken === "function") ? req.csrfToken() : undefined;
     log.info(`Generated CSRF token ${csrfToken} with secret ${res.getHeader("set-cookie")}`);
 
     // We force the page to not be cached since on mobile the CSRF token can be

src/routes/routes.ts

@@ -9,12 +9,13 @@ import auth from "../services/auth.js";
 import cls from "../services/cls.js";
 import sql from "../services/sql.js";
 import entityChangesService from "../services/entity_changes.js";
-import csurf from "csurf";
+import { doubleCsrf } from "csrf-csrf";
 import { createPartialContentHandler } from "@triliumnext/express-partial-content";
 import rateLimit from "express-rate-limit";
 import AbstractBeccaEntity from "../becca/entities/abstract_becca_entity.js";
 import NotFoundError from "../errors/not_found_error.js";
 import ValidationError from "../errors/validation_error.js";
+import sessionSecret from "../services/session_secret.js";
 
 // page routes
 import setupRoute from "./setup.js";
@@ -71,10 +72,15 @@ import etapiSpecialNoteRoutes from "../etapi/special_notes.js";
 import etapiSpecRoute from "../etapi/spec.js";
 import etapiBackupRoute from "../etapi/backup.js";
 
-const csrfMiddleware = csurf({
-    cookie: {
-        path: "" // empty, so cookie is valid only for the current path
-    }
+const { doubleCsrfProtection: csrfMiddleware } = doubleCsrf({
+  getSecret: () => sessionSecret,
+  cookieOptions: {
+    path: "",       // empty, so cookie is valid only for the current path
+    secure: false,
+    sameSite: false,
+    httpOnly: false,
+  },
+  cookieName: "_csrf",
 });
 
 const MAX_ALLOWED_FILE_SIZE_MB = 250;