認証境界としての BFF

ログインと Cookie 取得の実演

Cookie による保護リソース取得の実演

$ curl http://localhost:3000/api/items -b cookies.txt -c cookies.txt
※ Windows（PowerShell）では curl を curl.exe に読み替えてください

app.use(session({  secret: process.env.SESSION_SECRET,  name: 'sid',  cookie: {    httpOnly: true,    secure: process.env.NODE_ENV === 'production',    sameSite: 'lax',    maxAge: 1800000,  },  resave: false,  saveUninitialized: false,}));

router.post('/login', async (req, res) => {  const { username, password } = req.body;  const tokenResponse = await fetch('http://auth-service:4000/token', {    method: 'POST',    headers: { 'Content-Type': 'application/json' },    body: JSON.stringify({ username, password }),  });  const { access_token } = await tokenResponse.json();  req.session.accessToken = access_token;  res.json({ message: 'Logged in' });});

router.get('/api/items', async (req, res) => {  const accessToken = req.session.accessToken;  if (!accessToken) {    return res.status(401).json({ error: 'Not authenticated' });  }  const response = await fetch('http://api-service:5000/items', {    headers: { Authorization: `Bearer ${accessToken}` },  });  const data = await response.json();  res.json(data);});

CSRF トークンなしで拒否される実演

$ curl -X POST http://localhost:3000/api/items -H "Content-Type: application/json" -d @requests/new-item.json -b cookies.txt -c cookies.txt
※ Windows（PowerShell）では curl を curl.exe に読み替えてください

CSRF トークンを付けて成功する実演

$ curl http://localhost:3000/csrf-token -b cookies.txt -c cookies.txt$ curl -X POST http://localhost:3000/api/items -H "Content-Type: application/json" -H "X-CSRF-Token: {取得した値}" -d @requests/new-item.json -b cookies.txt -c cookies.txt
※ Windows（PowerShell）では curl を curl.exe に読み替えてください

function generateCsrfToken(req, res, next) {  if (!req.session.csrfToken) {    req.session.csrfToken = crypto.randomBytes(32).toString('hex');  }  next();} function validateCsrfToken(req, res, next) {  const token = req.headers['x-csrf-token'];  if (!token || token !== req.session.csrfToken) {    return res.status(403).json({ error: 'CSRF token invalid' });  }  next();}