Update csrf strategy

src/managers/session.ts

@@ -12,6 +12,7 @@ export const createLoggedInSession = async (
 ): Promise<null> => {
   // we store old session value to pass it to the new logged-in session
   // email will not be passed to the new session as it is not useful within logged session
+  // csrfToken should not be passed to the new session for security reasons
   const {
     interactionId,
     mustReturnOneOrganizationInPayload,

src/middlewares/csrf-protection.ts

@@ -1,36 +1,13 @@
 import { csrfSync } from 'csrf-sync';
-import { NextFunction, Request, Response } from 'express';
-import * as Sentry from '@sentry/node';
+import { Request } from 'express';
 
-const { generateToken, invalidCsrfTokenError, isRequestValid, revokeToken } =
-  csrfSync({
-    getTokenFromRequest: (req: Request) => {
-      return req.body['_csrf'];
-    },
-  });
+const { generateToken, csrfSynchronisedProtection } = csrfSync({
+  getTokenFromRequest: (req: Request) => {
+    return req.body['_csrf'];
+  },
+});
 
-export const csrfProtectionMiddleware = (
-  req: Request,
-  res: Response,
-  next: NextFunction
-) => {
-  const ignoredMethods = ['GET', 'HEAD', 'OPTIONS'];
-  const ignoredMethodsSet = new Set(ignoredMethods);
-  if (ignoredMethodsSet.has(req.method)) {
-    return next();
-  }
-
-  const isCsrfValid = isRequestValid(req);
-  // Csrf token cannot be re-used
-  revokeToken(req);
-  if (!isCsrfValid) {
-    const err = invalidCsrfTokenError;
-    Sentry.captureException(err);
-    return next(err);
-  }
-
-  next();
-};
+export const csrfProtectionMiddleware = csrfSynchronisedProtection;
 
 // Csrf tokens are new for each requests
-export const csrfToken = (req: Request) => generateToken(req, true);
+export const csrfToken = (req: Request) => generateToken(req);

src/views/user/unable-to-auto-join-organization.ejs

@@ -8,12 +8,7 @@
                 <div class="fr-card__desc">
                     <br />
                     <p>
-                        ⏱️ Notre équipe est en train de vous rattacher à
-                        <% if (locals.libelle) { %>
-                            l’organisation <%= libelle %>.
-                        <% } else { %>
-                            cette organisation.
-                        <% } %>
+                        ⏱️ Notre équipe est en train de vous rattacher à cette organisation.
                     </p>
                     <p>
                         Vous recevrez un email pour accéder à votre démarche dès que nous aurons terminé.