fix: Security migration from csurf to csrf-sync

[mtrezza]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.

Issue

Security migration from csurf to csrf-sync

Summary by CodeRabbit

• Security

  • Enhanced CSRF protection on the login route to strengthen defense against cross-site request forgery attacks and improve overall session security.

• Dependencies

  • Updated security-related dependencies to support the improved protection mechanism.

[parse-github-assistant]

🚀 Thanks for opening this pull request!

[parseplatformorg]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[coderabbitai]

📝 Walkthrough

Walkthrough

The pull request migrates CSRF protection from the csurf library to csrf-sync. A new CSRF protection middleware is created in Authentication.js with a custom token extractor and exposed as a public property, replacing direct csurf usage in the login route.

Changes

Cohort / File(s)	Summary
CSRF Middleware Migration Parse-Dashboard/Authentication.js, Parse-Dashboard/app.js, package.json	Replaces csurf with csrf-sync for CSRF protection. Introduces csrfSynchronisedProtection middleware with custom token extraction (from req.body._csrf or x-csrf-token header) in Authentication class, exposed as a public property. Updates login route to use the new protection mechanism. Dependency replaced in package.json.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

🚥 Pre-merge checks | ✅ 1 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description is incomplete; it omits the Approach section explaining the technical changes and does not include the Tasks checklist.	Add an Approach section detailing the migration steps and include the Tasks checklist with appropriate items checked or marked as N/A.
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (1 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately and concisely describes the main change: migrating from csurf to csrf-sync for security purposes.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

Parse-Dashboard/app.js (1)

1110-1110: ⚠️ Potential issue | 🔴 Critical

req.csrfToken() is not a function with csrf-sync — this will throw at runtime.

As detailed in the Authentication.js review, csrf-sync does not add csrfToken() to the request object. This line will throw TypeError: req.csrfToken is not a function when any user visits the login page, completely breaking authentication.

🤖 Fix all issues with AI agents

In `@Parse-Dashboard/app.js`:
- Line 1067: The GET /login route uses Authentication.csrfProtection
(csrfSynchronisedProtection) which ignores GET methods and therefore does not
generate req.csrfToken(); update the route handler for app.get('/login',
Authentication.csrfProtection, ...) to explicitly call
Authentication.generateToken(req) (or the equivalent generateToken function
referenced in Authentication.js) to create/retrieve the CSRF token and pass it
into the rendered login page (e.g., add the token to the view locals or template
data) so forms can embed the token; ensure you use the same token API defined in
Authentication.js and keep the middleware in place.

In `@Parse-Dashboard/Authentication.js`:
- Around line 3-10: The code currently only destructures
csrfSynchronisedProtection from csrfSync but not generateToken, so
req.csrfToken() in the login GET handler will break; update the csrfSync call in
Authentication.js to also destructure and export generateToken (alongside
csrfSynchronisedProtection) and then replace the call to req.csrfToken() in the
login GET handler in app.js with generateToken(req) to obtain and embed the CSRF
token.

[parseplatformorg]

🎉 This change has been released in version 8.5.0-alpha.2

[parseplatformorg]

🎉 This change has been released in version 8.5.0