http://coldfusion.com logo
Join Slack
Powered by
I am trying to inject the csrftoken on onrequesten...
# lucee
g
I am trying to inject the csrftoken on onrequestend but i am getting a blank page, i am using lucee 6
Copy code
<cffunction name="onRequestEnd" returntype="void">
    <cfargument name="targetPage" type="string" required="true">
    
    <cfset var response = getPageContext().getResponse()>
    <cfset var out = response.getWriter()>
    <cfset var content = out.toString()>
    
    <cfif not isJSON(content)>
        <cfcontent reset="true">
        <cfoutput>#injectCsrfToken(content)#</cfoutput>
    </cfif>
</cffunction>
i cehcked my logs file but nothing is appearing on it, is there another wy of doing the same thing or at least some error i should get
i removed it and then it shows 
text/html;charset=UTF-8
my code for csrfprotection in the function is not appearing
b
That all suggests that either the page content was blank to start with or the code is failing to read the original content. Do you get the correct output when onRequestEnd() does nothing?
so? where is 'injectCsrfToken()' defined? If that is your own method then you should be sharing that rather than the code in onRequestStart()
g
Yes the content is correct when the method is not used
q
the 
<cfcontent reset="true">
wipes out the existing buffer, so you will always have a blank page. Not sure why you think you need that there.
g
I removed that
this is what i have now
Copy code
<cffunction name="onRequestEnd" returntype="void">
    <cfargument name="targetPage" type="string" required="true">
    
    <cfset var response = getPageContext().getResponse()>
    <cfset var contentType = response.getContentType()>
    <cfdump var="#contentType#">
    <<cfif isNull(contentType) or contentType contains "text/html">
        <cfoutput>#injectCsrfToken(contentType)#</cfoutput>
    </cfif>
</cffunction>

<cffunction name="injectCsrfToken" access="private" returntype="string">
    <cfargument name="content" type="string" required="true">
    
    <cfset var csrfToken = session.csrfToken>
    <cfset var csrfScript = '
        <script nonce="#generateScriptNonce()#">
            document.addEventListener("DOMContentLoaded", function() {
                var forms = document.getElementsByTagName("form");
                for (var i = 0; i < forms.length; i++) {
                    var input = document.createElement("input");
                    input.type = "hidden";
                    input.name = "csrfToken";
                    input.value = "#csrfToken#";
                    forms[i].appendChild(input);
                }
                
                (function(open) {
                    XMLHttpRequest.prototype.open = function() {
                        open.apply(this, arguments);
                        this.setRequestHeader("X-CSRF-Token", "#csrfToken#");
                    };
                })(XMLHttpRequest.prototype.open);
            });
        </script>
    '>
    <cfdump var="#csrfScript#">
    <cfreturn replace(arguments.content, "</body>", "#csrfScript#</body>")>
</cffunction>
q
does every page you are trying to load have a 
</body>
tag? Might want to replace it with a regex or at least a 
ReplaceNoCase()
g
yes except the ajax callback pages apart from that yes all pages have it
q
and you aren't seeing the cfdump output either?
g
cfdump is showing, you see i have removed the cfcontent
q
I can't imagine this is firing the way you would expect : 
<<cfif isNull(contentType) or contentType contains "text/html">
g
ummm, but it does into the inject function
i can change it , if you have some idea on approaching it in a different way '
q
well, I don't know what you are really trying to do with that statement. Does contentType have your page content?
g
no, its showing as text//html;utf-8
that seems to be the problem
Open in Slack
PreviousNext
Powered by