feat(auth): cookies helpers and CSRF middleware

packages/backend/package.json

@@ -19,6 +19,7 @@
     "@flashcard/shared": "*",
     "bcryptjs": "^3.0.3",
     "better-sqlite3": "^11.0.0",
+    "cookie-parser": "^1.4.7",
     "drizzle-orm": "^0.33.0",
     "express": "^4.19.0",
     "multer": "^1.4.5-lts.1",
@@ -29,6 +30,7 @@
   "devDependencies": {
     "@types/bcryptjs": "^2.4.6",
     "@types/better-sqlite3": "^7.6.0",
+    "@types/cookie-parser": "^1.4.10",
     "@types/express": "^4.17.0",
     "@types/multer": "^1.4.0",
     "@types/node": "^20.0.0",

packages/backend/src/lib/cookies.ts

@@ -0,0 +1,34 @@
+import type { CookieOptions } from 'express';
+
+export const SID_COOKIE = 'flashcard_sid';
+export const CSRF_COOKIE = 'flashcard_csrf';
+export const CSRF_HEADER = 'x-csrf-token';
+
+export function sidCookieOptions(expiresAtSec: number): CookieOptions {
+  return {
+    httpOnly: true,
+    sameSite: 'lax',
+    secure: process.env.COOKIE_SECURE === 'true',
+    path: '/',
+    expires: new Date(expiresAtSec * 1000),
+  };
+}
+
+export function csrfCookieOptions(expiresAtSec: number): CookieOptions {
+  return {
+    httpOnly: false,
+    sameSite: 'lax',
+    secure: process.env.COOKIE_SECURE === 'true',
+    path: '/',
+    expires: new Date(expiresAtSec * 1000),
+  };
+}
+
+export function clearCookieOptions(): CookieOptions {
+  return {
+    httpOnly: true,
+    sameSite: 'lax',
+    secure: process.env.COOKIE_SECURE === 'true',
+    path: '/',
+  };
+}

packages/backend/src/middleware/csrf.ts

@@ -0,0 +1,25 @@
+import { randomBytes } from 'node:crypto';
+import type { Request, Response, NextFunction } from 'express';
+import { CSRF_COOKIE, CSRF_HEADER, csrfCookieOptions } from '../lib/cookies.js';
+import { ApiError } from '../lib/errors.js';
+
+const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
+
+export function ensureCsrfToken(req: Request, res: Response, next: NextFunction): void {
+  if (!req.cookies?.[CSRF_COOKIE]) {
+    const token = randomBytes(24).toString('base64url');
+    const expires = Math.floor(Date.now() / 1000) + 30 * 24 * 60 * 60;
+    res.cookie(CSRF_COOKIE, token, csrfCookieOptions(expires));
+  }
+  next();
+}
+
+export function verifyCsrf(req: Request, _res: Response, next: NextFunction): void {
+  if (SAFE_METHODS.has(req.method)) return next();
+  const cookieToken = req.cookies?.[CSRF_COOKIE];
+  const headerToken = req.headers[CSRF_HEADER];
+  if (!cookieToken || !headerToken || cookieToken !== headerToken) {
+    return next(new ApiError(403, 'CSRF_MISMATCH', 'CSRF token mismatch'));
+  }
+  next();
+}