[SOA-39] Enable CSRF (#40)

* refactor ✨ : enabled CSRF * fix ✅ (fe): hide feed actions if no authed user in context
mariadriana-deemaze · Nov 26, 2024 · 45448b8 · 45448b8
1 parent 4005d4b
commit 45448b8
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 6 deletions.
diff --git a/config/shield.ts b/config/shield.ts
@@ -16,9 +16,9 @@ const shieldConfig = defineConfig({
    * to learn more
    */
   csrf: {
-    enabled: false,
+    enabled: true,
     exceptRoutes: [],
-    enableXsrfCookie: false,
+    enableXsrfCookie: true,
     methods: ['POST', 'PUT', 'PATCH', 'DELETE'],
   },
 

diff --git a/inertia/components/posts/feed_list.tsx b/inertia/components/posts/feed_list.tsx
@@ -59,7 +59,7 @@ export default function FeedList({
         <Loader2 className="h-5 w-5 mr-2 animate-spin text-muted" />
       ) : (
         allPosts?.map((post, index) => (
-          <PostCard key={index} user={currentUser} post={post} redirect />
+          <PostCard key={index} user={currentUser} post={post} actions={!!currentUser} redirect />
         ))
       )}
       <div className="flex justify-center py-5 w-full min-w-full">

diff --git a/inertia/pages/feed.tsx b/inertia/pages/feed.tsx
@@ -10,9 +10,11 @@ export default function Feed({ posts, user }: InferPageProps<FeedController, 'in
     <>
       <Head title="Feed" />
       <FeedList url={route('feed.show').path} currentUser={user} posts={posts} />
-      <div className="z-10 fixed left-5 bottom-5">
-        <CreatePost />
-      </div>
+      {user && (
+        <div className="z-10 fixed left-5 bottom-5">
+          <CreatePost />
+        </div>
+      )}
     </>
   )
 }