javascript - Disable CSRF for a specific route? (Lusca) -


i have instructure canvas running on ubuntu server. clicking on link tool provider calls post rejected lusca, causing 403.

i've tried implement meddleware make exception. clicking tool link causes server hang minute, followed 403. no information appears in console me diagnose further. thoughts?

relevant folders structure

>node_modules  >meddleware  >lusca  >server   routes.js   express.js  >config    config.json  >lti    lti.controller.js    index.js

routes.js

  app.use('/lti', require('/lti'));

express.js

   var ltimiddleware = require("express-ims-lti");    var meddleware = require('meddleware'),         mconfig = require('shush')('/config.json');     export default function(app) {       app.use(meddleware(mconfig));       app.use(ltimiddleware({         consumer_key: "key",         consumer_secret: "secret",       }));

config.js

{   "middleware": {     "appsec": {       "module": {         "arguments": [           {             "xframe": "sameorigin",             "p3p": false,             "csp": false           }         ]       }     },     "csrf": {       "enabled": true,       "priority": 111,       "route": "./((?!lti))*",       "module": {         "name": "lusca",         "method": "csrf",         "arguments": [ {} ]       }     }    } }

lti/index.js

'use strict';  var express = require('express'); var controller = require('./lti.controller.js');  var router = express.router();  router.post('/', controller.index);  module.exports = router;

have excluded code/files try , keep brief , relevant.

thanks


Comments

Post a Comment

Popular posts from this blog

asynchronous - C# WinSCP .NET assembly: How to upload multiple files asynchronously -

i using winscp .net assembly uploading files. want upload multiple files asynchronous way. have created method works single upload. public class uploadingdata { private sessionoptions _sessionoptions; private session _session; //connection etc private void onconnected() { foreach (var fileinfo in localfileslist) { var task = task.factory.startnew(() => uploadfilesasync(fileinfo)); } } private async task uploadfilesasync(string file) { string remotefilepath = _session.translatelocalpathtoremote(file, @"/", "/test_data_upload"); var uploading = _session.putfiles(file, remotefilepath, false); //when done await task.run(() => thread.sleep(1000)); } } please suggest me correct way. thanks you can use backgroundworker class this: string[] images = new string[50]; foreach (var path in images) { backgroundworker
Read more

aws api gateway - SerializationException in posting new Records via Dynamodb Proxy Service in API -

i getting "__type": "com.amazon.coral.service#serializationexception" as reply in postman & in test console in api gateway trying post record directly dynamodb using api proxy services.. referring aws article - https://aws.amazon.com/blogs/compute/using-amazon-api-gateway-as-a-proxy-for-dynamodb/ here's mapping { "tablename": "tablenamegoeshere", "item": { "id" : "$context.requestid" "eventname" : "$input.path('$.eventname')", "timestamp" : $input.path('$.timestamp'), "answers": "$util.parsejson($input.path('$.answers'))" } } update: did asked ... , worked if try add array of json objects gives me above same error - here's trying now. please - couldnt find on google well #set($inputroot = $input.path('$')) { "tablename": "answer", "item": {
Read more

asp.net - Problems sending emails from forum -

i have been redesigning site has message board, has been written guy looked after site. it has few problems , written in .asp , uses .mdb files database. you can see whole thing here . feel free post if helps, test thing have set using original files , new database. the basic problem when posts message, supposed email sent them, have posted it. when replies, originator supposed message, replier has been posted. i’d have thought @ point in process there should script/file in postmessage.asp? the postmessage.asp page below. <% option explicit %> <!-- #include virtual="common/adovbs.inc" --> <html> <head> <meta http-equiv="content-type" content="text/html; charset=windows-1252"> <meta name="generator" content="microsoft frontpage 4.0"> <meta name="progid" content="frontpage.editor.document"> <title>new page 2</title> <base target="_self"
Read more