validate crumb when autoGenerate is false and crumb not defined on route

hapijs / crumb

CSRF crumb generation and validation for hapi

Other

171 stars 50 forks source link

validate crumb when autoGenerate is false and crumb not defined on route #131

Closed jspath closed 4 years ago

jspath commented 5 years ago

When autoGenerate is false, and the crumb is undefined on the route, the route never validates incoming crumb values.

Fixing this required:

gathering crumb settings for route even if autoGenerate is false and crumb is undefined for route
separating the reading of the crumb cookie from the generation of a new crumb value
read crumb cookie if crumb is enabled on route
generate crumb cookie if autoGenerate is true or crumb defined for route

Related issues: #108 #94

hueniverse commented 5 years ago

I'll try to review by the end of the month.

lock[bot] commented 4 years ago

This thread has been automatically locked due to inactivity. Please open a new issue for related bugs or questions following the new issue template instructions.