search

hapijs / crumb

CSRF crumb generation and validation for hapi
Other
171 stars 50 forks source link

autoGenerate=false not working as expected #108

Closed jamtay closed 5 years ago

jamtay commented 6 years ago

Tried setting autoGenerate to false but when this happened the crumb was never checked (Could update the hidden form field with any value and not get a 403 forbidden)

I had already globally set the crumbOptions but to fix this I also had to add an empty object for config.plugins.crumb for every route. With this changed autoGenerate worked as I expected but I am confused about why I have to add config.plugins.crumb to every route to fix this?

spanditcaa commented 6 years ago

This appears to be a duplicate of #94 -- @jspath is the PR you referenced in pangeamedia a fix, or workaround for crumb?

jspath commented 6 years ago

It's a "fix" that works for us against version 7.0.0 of crumb.

We are old an older version of hapi right now and cannot upgrade to newest crumb.

hueniverse commented 5 years ago

I am assuming this is not an issue anymore since it's been a year without progress on this. Since hapi v16 is no longer supported, I am closing it as the fix will not be backported. If you still need hapi v16 support including this module, please contact me for information about commercial support.

lock[bot] commented 4 years ago

This thread has been automatically locked due to inactivity. Please open a new issue for related bugs or questions following the new issue template instructions.