search

hapijs / crumb

CSRF crumb generation and validation for hapi
Other
171 stars 50 forks source link

validate crumb when autoGenerate is false and crumb not defined on route #130

Closed jspath closed 5 years ago

jspath commented 5 years ago

If you set autoGenerate to false, it disables crumb validation on routes which do not defined crumb options.

This fix ensures that autoGenerate does not affect crumb validation, while still being used properly to affect crumb generation.

Related issues: #108 and #94

jspath commented 5 years ago

This is not quite working as intended.

The way in which the generate method is responsible for both reading and/or generating the crumb value is causing problems.

I will resubmit a PR when I have a better fix.

lock[bot] commented 4 years ago

This thread has been automatically locked due to inactivity. Please open a new issue for related bugs or questions following the new issue template instructions.