Express middleware provider that rejects HTTP requests lacking a valid connection token.
The connection-token cookie is only bootstrapped globally (see
BrowserConnectionTokenBackendContribution); enforcement is opt-in per route.
Security-sensitive HTTP endpoints (e.g. the filesystem upload/download routes) should
inject this and apply validateRequest as route middleware. Non-sensitive routes
(the initial HTML page, static assets) must not use it, as they legitimately have no
cookie yet on the very first page load.
Express middleware that calls next() when the request carries a valid connection-token
cookie (or when running in Electron) and responds with 403 otherwise.
Express middleware provider that rejects HTTP requests lacking a valid connection token.
The connection-token cookie is only bootstrapped globally (see BrowserConnectionTokenBackendContribution); enforcement is opt-in per route. Security-sensitive HTTP endpoints (e.g. the filesystem upload/download routes) should inject this and apply validateRequest as route middleware. Non-sensitive routes (the initial HTML page, static assets) must not use it, as they legitimately have no cookie yet on the very first page load.