Dependabot Alert: Axios Cross-Site Request Forgery Vulnerability

GSA / smartpay-training

Prototype for new GSA SmartPay training quizzes

8 stars 4 forks source link

Dependabot Alert: Axios Cross-Site Request Forgery Vulnerability #470

Open JennaySDavis opened 6 months ago

JennaySDavis commented 6 months ago

Upgrade axios to fix 1 Dependabot alert in training-front-end/package-lock.json

An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host, allowing attackers to view sensitive information.

JennaySDavis commented 5 months ago

#470 Acceptance Criteria

Pass/Fail	Description
Pass	Smoke Testing of Training app.

Comments/Additional Notes Performance score will increase when https://github.com/orgs/GSA/projects/43/views/1?pane=issue&itemId=46203471 is completed. A Link checker was completed on the app - no broken links.

ADA Compliance (Automated scan via Chrome Lighthouse)	Criteria	Score
Performance	96*
Accessibility	100
Best Practices	100

*average several scans were completed

Passed 02/2/2024 - JSD

LoraBradford commented 5 months ago

Thank you! Approved with the understanding that #455 will increase score. Moving to done!