الـ Cookie Flags والـ CSRF: المتصفح بيبعت الـ cookie، فلازم تتأكد مين اللي طلب

// المتصفح بتاع الضحية، وهي فاتحة صفحة المهاجم (evil.example)
const base = "http://localhost:3000";

// الضحية عاملة login في البنك من بدري، فالمتصفح شايل الـ cookie
const login = await fetch(`${base}/login`, { method: "POST" });
const cookie = login.headers.get("set-cookie").split(";")[0];
console.log("cookie الضحية:", login.headers.get("set-cookie"));

// صفحة المهاجم فيها <form action="http://localhost:3000/transfer" method="POST"> بتتبعت لوحدها.
// المتصفح بيبعت الـ cookie معاها، وبيضيف Origin و Sec-Fetch-Site من عنده (الصفحة ما تقدرش تغيّرهم).
const res = await fetch(`${base}/transfer`, {
  method: "POST",
  headers: {
    cookie,
    origin: "https://evil.example",
    "sec-fetch-site": "cross-site",
    "content-type": "application/x-www-form-urlencoded",
  },
  body: "to=attacker&amount=4000",
});
console.log("الهجمة:", res.status, await res.text());

$ node server.js & sleep 0.8; node attack.js; kill $!
http://localhost:3000
cookie الضحية: sid=BVP4DCyCFBf499XTLQLS2ix1iq3Rmeil; Path=/; HttpOnly
حوّلنا 4000 لـ attacker ← الرصيد 1000
الهجمة: 200 {"ok":true,"balance":1000}

const base = "http://localhost:3000";
const login = await fetch(`${base}/login`, { method: "POST" });
console.log("cookie:", login.headers.get("set-cookie"));
const cookie = login.headers.get("set-cookie").split(";")[0];
const form = "application/x-www-form-urlencoded";

async function transfer(label, headers) {
  const res = await fetch(`${base}/transfer`, {
    method: "POST",
    headers: { cookie, "content-type": form, ...headers },
    body: "to=x&amount=100",
  });
  console.log(label.padEnd(30), res.status, await res.text());
}

await transfer("المهاجم (cross-site)", { origin: "https://evil.example", "sec-fetch-site": "cross-site" });
await transfer("subdomain (same-site)", { origin: "https://blog.bank.example", "sec-fetch-site": "same-site" });
await transfer("متصفح قديم + origin غريب", { origin: "https://evil.example" });
await transfer("الموقع نفسه", { origin: "https://bank.example", "sec-fetch-site": "same-origin" });

$ node server.js & sleep 0.8; node attack2.js; kill $!
http://localhost:3000
cookie: __Host-sid=vjLX0vo6Kj8XrY8boZhJr9OB539W8kpw; Path=/; HttpOnly; Secure; SameSite=Lax
المهاجم (cross-site)           403 {"error":"cross-site (cross-site)"}
subdomain (same-site)          403 {"error":"cross-site (same-site)"}
متصفح قديم + origin غريب       403 {"error":"origin مش مسموح: https://evil.example"}
الموقع نفسه                    200 {"ok":true,"balance":4900}

import express from "express";
import crypto from "node:crypto";

const app = express();
app.use(express.urlencoded({ extended: false }), express.json());
const sessions = new Map(); // sid → { user, balance, csrf }
const sidOf = (req) => req.get("cookie")?.match(/(?:^|; )__Host-sid=([^;]+)/)?.[1];

const random = () => crypto.randomBytes(32).toString("base64url");
const COOKIE = { httpOnly: true, secure: true, sameSite: "lax", path: "/" };

function sameToken(a, b) {
  if (typeof a !== "string" || typeof b !== "string") return false;
  const x = Buffer.from(a);
  const y = Buffer.from(b);
  return x.length === y.length && crypto.timingSafeEqual(x, y);
}

app.post("/login", (req, res) => {
  const old = sidOf(req);
  if (old) sessions.delete(old);
  const sid = random();
  sessions.set(sid, { user: "mona", balance: 5000, csrf: random() });
  res.cookie("__Host-sid", sid, COOKIE);
  res.json({ ok: true });
});

app.use((req, res, next) => {
  req.session = sessions.get(sidOf(req)) ?? null;
  next();
});

app.get("/csrf", (req, res) => {
  if (!req.session) return res.status(401).json({ error: "سجّل دخول" });
  res.json({ csrf: req.session.csrf });
});

function csrf(req, res, next) {
  if (["GET", "HEAD", "OPTIONS"].includes(req.method)) return next();
  if (!req.session) return res.status(401).json({ error: "سجّل دخول" });
  const sent = req.get("x-csrf-token") ?? req.body?._csrf;
  if (!sameToken(sent, req.session.csrf)) return res.status(403).json({ error: "csrf token غلط" });
  next();
}

app.post("/transfer", csrf, (req, res) => {
  req.session.balance -= Number(req.body.amount);
  res.json({ ok: true, balance: req.session.balance });
});

app.listen(3000, () => console.log("http://localhost:3000"));

$ node server.js & sleep 0.8; node test.js; kill $!
http://localhost:3000
token طوله: 43
من غير token:       403
token غلط:          403
header صح:          { ok: true, balance: 4900 }
_csrf في الـ form:   { ok: true, balance: 4800 }
token اتغيّر بعد login تاني؟ true
القديم بعد الـ login: 403

const base = "http://localhost:3000";
let cookie = "";
async function call(method, path, { body, headers = {} } = {}) {
  const res = await fetch(base + path, {
    method,
    headers: { cookie, "content-type": "application/x-www-form-urlencoded", ...headers },
    body,
  });
  const set = res.headers.get("set-cookie");
  if (set) cookie = set.split(";")[0];
  return { status: res.status, data: await res.json() };
}

await call("POST", "/login");
const { data } = await call("GET", "/csrf");
const token = data.csrf;
console.log("token طوله:", token.length);
console.log("من غير token:      ", (await call("POST", "/transfer", { body: "amount=100" })).status);
console.log("token غلط:         ", (await call("POST", "/transfer", { body: "amount=100", headers: { "x-csrf-token": "x" } })).status);
console.log("header صح:         ", (await call("POST", "/transfer", { body: "amount=100", headers: { "x-csrf-token": token } })).data);
console.log("_csrf في الـ form:  ", (await call("POST", "/transfer", { body: `amount=100&_csrf=${token}` })).data);
await call("POST", "/login");
const after = (await call("GET", "/csrf")).data.csrf;
console.log("token اتغيّر بعد login تاني؟", after !== token);
console.log("القديم بعد الـ login:", (await call("POST", "/transfer", { body: "amount=1", headers: { "x-csrf-token": token } })).status);