hapijs / crumb

CSRF crumb generation and validation for hapi
Other
171 stars 50 forks source link

New crumb is not generated on browser refresh #92

Closed genediazjr closed 8 years ago

genediazjr commented 8 years ago

I am not sure if this is just on my machine and if this is the intended design. I have tested this on chrome and firefox with the same result.

I have used the following code:

const Hapi = require('hapi');
const server = new Hapi.Server();

server.connection({ port: 8001 });
server.register(require('crumb'));
server.route({ 
    path: '/', 
    method: 'get',
    handler: (request, reply) => {
        return reply();
    }
});

server.inject({ url: '/', method: 'get' }, (res) => {

    console.log(res.headers['set-cookie'][0].split(';')[0].replace('crumb=', ''));

    server.inject({ url: '/', method: 'get' }, (res) => {

        // new value is generated
        console.log(res.headers['set-cookie'][0].split(';')[0].replace('crumb=', ''));
    });
});

server.start();

Using server.inject generates a new value. But accessing it on the browser does not.

First access. 1

Second access. Still the same crumb value 2

stongo commented 8 years ago

This is the expected behavior. In the browser the first request sets the crumb in a cookie. On subsequent requests, if the cookie is already set it doesn't set a new crumb again. Since you're not passing a cookie in the server.inject calls, it generates a new one every time. If you want a new crumb generated more frequently, set a low cookie expiry using the plugins' cookieOptions

genediazjr commented 8 years ago

I see. Thank you for clarifying.

lock[bot] commented 4 years ago

This thread has been automatically locked due to inactivity. Please open a new issue for related bugs or questions following the new issue template instructions.