diff --git a/packages/astro/src/core/app/middlewares.ts b/packages/astro/src/core/app/middlewares.ts index 6a804627d7..7c589f0c4d 100644 --- a/packages/astro/src/core/app/middlewares.ts +++ b/packages/astro/src/core/app/middlewares.ts @@ -25,7 +25,7 @@ export function createOriginCheckMiddleware(): MiddlewareHandler { if (isPrerendered) { return next(); } - if (request.method === "GET") { + if (request.method === 'GET') { return next(); } const sameOrigin = @@ -34,8 +34,8 @@ export function createOriginCheckMiddleware(): MiddlewareHandler { request.method === 'PATCH' || request.method === 'DELETE') && request.headers.get('origin') === url.origin; - - const hasContentType = request.headers.has('content-type') + + const hasContentType = request.headers.has('content-type'); if (hasContentType) { const formLikeHeader = hasFormLikeHeader(request.headers.get('content-type')); if (formLikeHeader && !sameOrigin) { @@ -51,7 +51,7 @@ export function createOriginCheckMiddleware(): MiddlewareHandler { } } - return next() + return next(); }); } diff --git a/packages/astro/test/csrf-protection.test.js b/packages/astro/test/csrf-protection.test.js index f8067000d2..5b70e36505 100644 --- a/packages/astro/test/csrf-protection.test.js +++ b/packages/astro/test/csrf-protection.test.js @@ -48,17 +48,20 @@ describe('CSRF origin check', () => { assert.equal(response.status, 403); request = new Request('http://example.com/api/', { - headers: { origin: 'http://loreum.com', 'content-type': 'application/x-www-form-urlencoded; some-other-value' }, + headers: { + origin: 'http://loreum.com', + 'content-type': 'application/x-www-form-urlencoded; some-other-value', + }, method: 'POST', }); response = await app.render(request); assert.equal(response.status, 403); request = new Request('http://example.com/api/', { - headers: { origin: 'http://loreum.com', }, + headers: { origin: 'http://loreum.com' }, method: 'POST', credentials: 'include', - body: new Blob(["a=b"],{}) + body: new Blob(['a=b'], {}), }); response = await app.render(request); assert.equal(response.status, 403);