@github/auto-check-element - npm Package Compare versions

Comparing version 5.0.2 to 5.1.0

dist/index.esm.js

@@ -116,3 +116,4 @@ function throttle(callback) {
   get csrf() {
-    return this.getAttribute('csrf') || '';
+    const csrfElement = this.querySelector('[data-csrf]');
+    return this.getAttribute('csrf') || csrfElement instanceof HTMLInputElement && csrfElement.value || '';
   }
@@ -119,0 +120,0 @@

dist/index.umd.js

@@ -122,3 +122,4 @@ (function (global, factory) {
     get csrf() {
-      return this.getAttribute('csrf') || '';
+      const csrfElement = this.querySelector('[data-csrf]');
+      return this.getAttribute('csrf') || csrfElement instanceof HTMLInputElement && csrfElement.value || '';
     }
@@ -125,0 +126,0 @@

package.json

 {
   "name": "@github/auto-check-element",
-  "version": "5.0.2",
+  "version": "5.1.0",
   "description": "An input element that validates its value with a server endpoint.",
@@ -5,0 +5,0 @@ "repository": "github/auto-check-element",

README.md

@@ -23,2 +23,11 @@ # <auto-check> element
 
+Note that in the following example the CSRF element is marked with the `data-csrf` attribute rather than `name` so that the value doesn't get posted to the backend when the element is placed in a form.
+
+```erb
+<auto-check src="/signup-check/username">
+  <input>
+  <input hidden data-csrf value="<%= authenticity_token_for("/signup-check/username") %>">
+</auto-check>
+```
+
 ## Attributes
@@ -28,2 +37,3 @@
 - `csrf` is the [CSRF][] token for the posted form. It's available in the request body as a `authenticity_token` form parameter.
+  - You can also supply the CSRF token via a child element. See [usage](#Usage) example.
 - `required` is a boolean attribute that requires the validation to succeed before the surrounding form may be submitted.
@@ -30,0 +40,0 @@

Fixed alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

23595

3.11%

Lines of code

527

0.38%

Number of lines in readme file

151

7.09%

Number of medium supply chain risk alerts

1

-50%

No dependency changes