search

koajs / csrf

CSRF tokens for koa
MIT License
264 stars 32 forks source link

allow csrf secrets to be set somewhere other than .session.secret #9

Closed jonathanong closed 7 years ago

jonathanong commented 10 years ago

not sure where or how.

jonathanong commented 8 years ago

might need to add a get() and set() function

dantman commented 8 years ago

I'd like to do this with a signed cookie.

I'm writing a app-like site that does all the routing client side and instead of sessions uses localStorage to save a JWT and includes that in api calls.

This actually means that I don't even need csrf protection in api calls involving a user. However I do still need csrf protection in oauth based signin flows (ie: Facebook/Google social logins) and in password signup/signin api calls to protect from password brute forcing attempted using other people's browsers.

So I don't use or desire sessions, but I do need a csrf token tied to a cookie.

stephenmathieson commented 7 years ago

@jonathanong is this still relevant/needed? I think it's a little weird that we claim such a generic field on .session, but it's never caused me problems.

IMO we should close this since the last comment is a year old and folks are still using this package daily.

jonathanong commented 7 years ago

yeah we can close this. nowadays, i think other types of session should just implement CSRF themselves