Merge pull request #3 from wiseaidev/csrf-fairing

Csrf fairing

Author: wiseaidev

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "rocket_csrf_token"
-version = "0.3.1"
+version = "0.3.2"
 authors = ["Alex Kotov <kotovalexarian@gmail.com>", "Mahmoud Harmouch <oss@wiseai.dev>"]
 edition = "2021"
 description = "CSRF (Cross-Site Request Forgery) protection for Rocket web framework"

README.md

@@ -115,11 +115,11 @@ See the complete code in [minimal example](examples/minimal).
 
 ## TODO
 
-- [ ] Add fairing to verify all requests as an option.
+- [X] Add fairing to verify all requests as an option (Requires unit tests).
+- [X] Verify `X-CSRF-Token` header (Requires unit tests).
+- [X] Set cookie to expire with session (Requires unit tests).
 - [ ] Add [data guard](https://api.rocket.rs/v0.5-rc/rocket/data/trait.FromData.html) to verify forms with a guard.
 - [ ] Add helpers to render form field.
-- [ ] Add helpers to add HTML meta tags for Ajax with `X-CSRF-Token` header.
-- [ ] Verify `X-CSRF-Token` header.
+- [ ] Add helpers to add HTML meta tags for Ajax with `X-CSRF-Token` header (WIP).
 - [ ] Use authenticity token encryption from [Ruby on Rails](https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_controller/metal/request_forgery_protection.rb).
 - [ ] Allow to configure CSRF protection (CSRF token byte length, cookie name, etc.).
-- [ ] Set cookie to expire with session.

examples/minimal/src/main.rs

@@ -58,7 +58,7 @@ fn new(
     _authenticated: Authenticated,
 ) -> Template {
     let template_context = TemplateContext {
-        authenticity_token: csrf_token.authenticity_token().to_string(),
+        authenticity_token: csrf_token.authenticity_token().unwrap().to_string(),
         flash: flash.map(|flash| flash.message().to_string()),
     };
 
@@ -71,7 +71,6 @@ fn create(
     form: Form<Comment>,
     _authenticated: Authenticated,
 ) -> Flash<Redirect> {
-    println!("{:?}", form.authenticity_token);
     if let Err(_) = csrf_token.verify(&form.authenticity_token) {
         return Flash::error(Redirect::to(uri!(new)), "Invalid authenticity token");
     }