search

hapijs / crumb

CSRF crumb generation and validation for hapi
Other
171 stars 51 forks source link

Auto generate fix #109

Closed jspath closed 6 years ago

jspath commented 6 years ago

Setting autoGenerate to false not only disabled automatically setting the cookie for every route, it also resulted in not READING the cookie for every route.

The problem is that the author combined READING the cookie with SETTING the cookie.

My solution, so far, is to ensure that we always try to READ the cookie, even if we aren't going to be SETTING (autoGenerating) the cookie.

I'm thinking that a better solution may be to separate the reading and setting so that they don't both reside in a function called generate, which seems weird to me.

jspath commented 6 years ago

I did not mean to create this against the main crumb repo! Sorry about that.

lock[bot] commented 4 years ago

This thread has been automatically locked due to inactivity. Please open a new issue for related bugs or questions following the new issue template instructions.