Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@fastify/csrf-protection
Advanced tools
This plugin helps developers protect their Fastify server against CSRF attacks. In order to fully protect against CSRF, developers should study Cross-Site Request Forgery Prevention Cheat Sheet in depth. See also pillarjs/understanding-csrf as a good guide.
Securing applications against CSRF is a developer responsibility and it should not be fully trusted to any third party modules. We do not claim that this module is able to protect an application without a clear study of CSRF, its impact and the needed mitigations. @fastify/csrf-protection provides a series of utilities that developers can use to secure their application. We recommend using @fastify/helmet to implement some of those mitigations.
Security is always a tradeoff between risk mitigation, functionality, performance, and developer experience. As a result we will not consider a report of a plugin default configuration option as security vulnerability that might be unsafe in certain scenarios as long as this module provides a way to provide full mitigation through configuration.
npm i @fastify/csrf-protection
@fastify/cookie
If you use @fastify/csrf-protection
with @fastify/cookie
, the CSRF secret will be added to the response cookies.
By default, the cookie used will be named _csrf
, but you can rename it via the cookieKey
option.
When cookieOpts
are provided, they override the default cookie options. Make sure you restore any of the default options which provide sensible and secure defaults.
fastify.register(require('@fastify/cookie'))
fastify.register(require('@fastify/csrf-protection'))
// if you want to sign cookies:
fastify.register(require('@fastify/cookie'), { secret }) // See following section to ensure security
fastify.register(require('@fastify/csrf-protection'), { cookieOpts: { signed: true } })
// generate a token
fastify.route({
method: 'GET',
path: '/',
handler: async (req, reply) => {
const token = await reply.generateCsrf()
return { token }
}
})
// protect a route
fastify.route({
method: 'POST',
path: '/',
onRequest: fastify.csrfProtection,
handler: async (req, reply) => {
return req.body
}
})
@fastify/session
If you use @fastify/csrf-protection
with @fastify/session
, the CSRF secret will be added to the session.
By default, the key used will be named _csrf
, but you can rename it via the sessionKey
option.
fastify.register(require('@fastify-session'))
fastify.register(require('@fastify/csrf-protection'), { sessionPlugin: '@fastify/session' })
// generate a token
fastify.route({
method: 'GET',
path: '/',
handler: async (req, reply) => {
const token = await reply.generateCsrf()
return { token }
}
})
// protect a route
fastify.route({
method: 'POST',
path: '/',
onRequest: fastify.csrfProtection,
handler: async (req, reply) => {
return req.body
}
})
@fastify/secure-session
If you use @fastify/csrf-protection
with @fastify/secure-session
, the CSRF secret will be added to the session.
By default, the key used will be named _csrf
, but you can rename it via the sessionKey
option.
fastify.register(require('@fastify/secure-session'))
fastify.register(require('@fastify/csrf-protection'), { sessionPlugin: '@fastify/secure-session' })
// generate a token
fastify.route({
method: 'GET',
path: '/',
handler: async (req, reply) => {
const token = await reply.generateCsrf()
return { token }
}
})
// protect a route
fastify.route({
method: 'POST',
path: '/',
onRequest: fastify.csrfProtection,
handler: async (req, reply) => {
return req.body
}
})
The secret
shown in the code above is strictly just an example. In all cases, you would need to make sure that the secret
is:
.env
files or anywhere in the repositoryApart from these safeguards, it is extremely important to use HTTPS for your website/app to avoid a bunch of other potential security issues like MITM attacks etc.
Options | Description |
---|---|
cookieKey | The name of the cookie where the CSRF secret will be stored, default _csrf . |
cookieOpts | The cookie serialization options. See @fastify/cookie. |
sessionKey | The key where to store the CSRF secret in the session. |
getToken | A sync function to get the CSRF secret from the request. |
getUserInfo | A sync function to get the a string of user-specific information to prevent cookie tossing. |
sessionPlugin | The session plugin that you are using (if applicable). |
csrfOpts | The csrf options. See @fastify/csrf. |
reply.generateCsrf([opts])
Generates a secret (if it is not already present) and returns a promise that resolves to the associated secret.
const token = await reply.generateCsrf()
You can also pass the cookie serialization options to the function.
The option userInfo
is required if getUserInfo
has been specified in the module option.
The provided userInfo
is hashed inside the csrf token and it is not directly exposed.
This option is needed to protect against cookie tossing.
The option csrfOpts.hmacKey
is required if getUserInfo
has been specified in the module option in combination with using @fastify/cookie as sessionPlugin
fastify.csrfProtection(request, reply, next)
A hook that you can use for protecting routes or entire plugins from CSRF attacks.
Generally, we recommend using an onRequest
hook, but if you are sending the token
via the request body, then you must use a preValidation
or preHandler
hook.
// protect the fastify instance
fastify.addHook('onRequest', fastify.csrfProtection)
// protect a single route
fastify.route({
method: 'POST',
path: '/',
onRequest: fastify.csrfProtection,
handler: async (req, reply) => {
return req.body
}
})
You can configure the function to read the CSRF token via the getToken
option, by default the following is used:
function getToken (req) {
return (req.body && req.body._csrf) ||
req.headers['csrf-token'] ||
req.headers['xsrf-token'] ||
req.headers['x-csrf-token'] ||
req.headers['x-xsrf-token']
}
It is recommended to provide a custom getToken
function for performance and security reasons.
fastify.register(require('@fastify/csrf-protection'),
{ getToken: function (req) { return req.headers['csrf-token'] } }
)
or
fastify.register(require('@fastify/csrf-protection'),
{ getToken: (req) => req.headers['csrf-token'] }
)
FAQs
A plugin for adding CSRF protection to Fastify.
The npm package @fastify/csrf-protection receives a total of 9,681 weekly downloads. As such, @fastify/csrf-protection popularity was classified as popular.
We found that @fastify/csrf-protection demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.