added csrf token to /shots route. fixes #2730

mozilla-services · Apr 25, 2017 · 2c8eb39 · 2c8eb39
1 parent 25d5e22
commit 2c8eb39
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/server/src/pages/shotindex/server.js b/server/src/pages/shotindex/server.js
@@ -1,12 +1,13 @@
 const express = require("express");
+const csrf = require("csurf");
 const reactrender = require("../../reactrender");
 const { Shot } = require("../../servershot");
 
 let app = express();
 
 exports.app = app;
 
-app.get("/", function(req, res) {
+app.get("/", csrf({cookie: true}), function(req, res) {
   if (!req.deviceId) {
     _render();
     return;