Harden cookie authentication

server/api/auth/register.post.ts

@@ -1,10 +1,15 @@
 import { readBody, setCookie, setResponseStatus } from "h3"
 import argon2 from "argon2"
 import { User } from "../../models/user"
-import { REFRESH_COOKIE } from "../../utils/auth"
+import {
+	assertCookieRequestOrigin,
+	defineAuthenticatedEventHandler,
+	REFRESH_COOKIE,
+} from "../../utils/auth"
 import { getAuthValidationMessage } from "../../utils/auth-validation"
 
-export default defineEventHandler(async (event) => {
+export default defineAuthenticatedEventHandler(async (event) => {
+	assertCookieRequestOrigin(event)
 	const body = await readBody(event)
 	const validationMessage = getAuthValidationMessage(body, [
 		{ name: "name" },

server/api/auth/session.post.ts

@@ -2,13 +2,15 @@ import { getCookie, readBody, setCookie, setResponseStatus } from "h3"
 import { User } from "../../models/user"
 import { getSessionModel } from "../../models/session"
 import {
+	assertCookieRequestOrigin,
+	defineAuthenticatedEventHandler,
 	getSessionTtl,
 	REFRESH_COOKIE,
 	SESSION_COOKIE,
 } from "../../utils/auth"
 import { getAuthValidationMessage } from "../../utils/auth-validation"
 
-export default defineEventHandler(async (event) => {
+export default defineAuthenticatedEventHandler(async (event) => {
 	const body = await readBody(event).catch(() => undefined)
 	const validationMessage =
 		body === undefined ? null : getAuthValidationMessage(body, [{ name: "refreshToken" }])
@@ -17,9 +19,10 @@ export default defineEventHandler(async (event) => {
 		return { message: validationMessage }
 	}
 
-	const refreshToken =
-		(typeof body?.refreshToken === "string" && body.refreshToken) ||
-		getCookie(event, REFRESH_COOKIE)
+	const bodyRefreshToken = typeof body?.refreshToken === "string" && body.refreshToken
+	const cookieRefreshToken = getCookie(event, REFRESH_COOKIE)
+	if (!bodyRefreshToken && cookieRefreshToken) assertCookieRequestOrigin(event)
+	const refreshToken = bodyRefreshToken || cookieRefreshToken
 
 	if (!refreshToken) {
 		setResponseStatus(event, 401)

server/api/auth/signin.post.ts

@@ -1,10 +1,15 @@
 import { readBody, setCookie, setResponseStatus } from "h3"
 import argon2 from "argon2"
 import { User } from "../../models/user"
-import { REFRESH_COOKIE } from "../../utils/auth"
+import {
+	assertCookieRequestOrigin,
+	defineAuthenticatedEventHandler,
+	REFRESH_COOKIE,
+} from "../../utils/auth"
 import { getAuthValidationMessage } from "../../utils/auth-validation"
 
-export default defineEventHandler(async (event) => {
+export default defineAuthenticatedEventHandler(async (event) => {
+	assertCookieRequestOrigin(event)
 	const body = await readBody(event)
 	const validationMessage = getAuthValidationMessage(body, [
 		{ name: "email", email: true },

server/api/auth/signout.post.ts

@@ -1,7 +1,13 @@
 import { deleteCookie } from "h3"
-import { REFRESH_COOKIE, SESSION_COOKIE } from "../../utils/auth"
+import {
+	assertCookieRequestOrigin,
+	defineAuthenticatedEventHandler,
+	REFRESH_COOKIE,
+	SESSION_COOKIE,
+} from "../../utils/auth"
 
-export default defineEventHandler((event) => {
+export default defineAuthenticatedEventHandler((event) => {
+	assertCookieRequestOrigin(event)
 	deleteCookie(event, REFRESH_COOKIE, { path: "/", sameSite: "lax", secure: !import.meta.dev })
 	deleteCookie(event, SESSION_COOKIE, { path: "/", sameSite: "lax", secure: !import.meta.dev })
 	return { success: true }