b35c524ba5
- Introduce CSRF token generation and management improvements, ensuring tokens are consistently retrieved from cookies or request state. - Update user creation logic to handle validation errors more gracefully, providing user feedback for invalid input and existing email addresses. - Revise user management UI to display success and error messages, improving user experience during user creation. - Refactor admin user access checks to include additional role validation.
29 lines
921 B
Python
29 lines
921 B
Python
import secrets
|
|
|
|
from fastapi import HTTPException, Request, status
|
|
|
|
|
|
CSRF_COOKIE_NAME = "csrf_token"
|
|
CSRF_FORM_FIELD = "csrf_token"
|
|
|
|
|
|
def generate_csrf_token() -> str:
|
|
return secrets.token_urlsafe(32)
|
|
|
|
|
|
def ensure_csrf_cookie(request: Request) -> str:
|
|
"""Liefert das CSRF-Token für die aktuelle Anfrage (Cookie oder request.state)."""
|
|
state_token = getattr(request.state, "csrf_token", None)
|
|
if state_token:
|
|
return state_token
|
|
cookie_token = request.cookies.get(CSRF_COOKIE_NAME)
|
|
if cookie_token:
|
|
return cookie_token
|
|
return generate_csrf_token()
|
|
|
|
|
|
def validate_csrf(request: Request, form_token: str) -> None:
|
|
cookie_token = request.cookies.get(CSRF_COOKIE_NAME)
|
|
if not cookie_token or not form_token or not secrets.compare_digest(cookie_token, form_token):
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="CSRF-Validierung fehlgeschlagen.")
|