Implement CSRF

src/scripts/api.js

@@ -1,44 +1,60 @@
 export default class Api {
 
-	constructor({server, processPage, timezone, errorCode, lang}) {
+	constructor({server, processPage, timezone, csrfToken, errorCode, lang}) {
 		this.server = server;
 		this.processPage = processPage;
 		this.timezone = timezone;
+		this.csrfToken = csrfToken;
 		this.errorCode = errorCode;
 		this.lang = lang;
 	}
 
-	async get(action, params = {}) {
-		const response = await this.request(action, params);
+	async get(sAction, asParams = {}) {
+		const response = await this.request(sAction, asParams, 'GET');
 		return response.data;
 	}
 
-	async request(action, params = {}) {
-		const requestParams = {
-			...params,
-			a: action,
+	async post(sAction, asParams = {}) {
+		const response = await this.request(sAction, asParams, 'POST');
+		return response.data;
+	}
+
+	async request(sAction, asParams = {}, method = 'GET') {
+		const oUrl = new URL(this.processPage, this.server);
+
+		const sUrlParams = new URLSearchParams({
+			...asParams,
+			a: sAction,
 			t: this.timezone
+		}).toString();
+
+		const asOptions = {
+			method,
+			headers: {'Accept': 'application/json'}
 		};
 
-		const url = new URL(this.processPage, this.server);
-		url.search = new URLSearchParams(requestParams).toString();
-
-		const request = await fetch(url, {
-			method: 'GET',
-			headers: {'Content-Type': 'application/json'}
-		});
-
-		if(!request.ok) {
-			throw new Error('Error HTTP ' + request.status + ': ' + request.statusText);
+		if(method === 'GET') {
+			oUrl.search = sUrlParams;
+		}
+		else {
+			asOptions.headers['Content-Type'] = 'application/x-www-form-urlencoded;charset=UTF-8';
+			asOptions.headers['X-CSRF-Token'] = this.csrfToken;
+			asOptions.body = sUrlParams;
 		}
 
-		const response = await request.json();
-		response.desc = this.lang.parse(response.desc);
+		const oRequest = await fetch(oUrl, asOptions);
 
-		if(response.result == this.errorCode) {
-			throw response.desc;
+		if(!oRequest.ok) {
+			throw new Error('Error HTTP ' + oRequest.status + ': ' + oRequest.statusText);
 		}
 
-		return response;
+		const oResponse = await oRequest.json();
+		oResponse.desc = this.lang.parse(oResponse.desc);
+
+		if(oResponse.result == this.errorCode) {
+			throw oResponse.desc;
+		}
+
+		return oResponse;
 	}
 }