Socket
Socket
Sign inDemoInstall

@npmcorp/crumb

Package Overview
Dependencies
36
Maintainers
18
Versions
5
Alerts
File Explorer

Advanced tools

Install Socket

Detect and block malicious and high-risk dependencies

Install

    @npmcorp/crumb

CSRF crumb generation and validation plugin


Version published
Weekly downloads
2
Maintainers
18
Install size
5.33 MB
Created
Weekly downloads
 

Readme

Source

crumb Logo

CSRF crumb generation and validation for hapi

Build Status

Lead Maintainer: Marcus Stong

CORS

Crumb has been refactored to securely work with CORS, as OWASP recommends using CSRF protection with CORS.

It is highly discouraged to have a production servers cors.origin setting set to "[*]" or "true" with Crumb as it will leak the crumb token to potentially malicious sites

Plugin Options

The following options are available when registering the plugin

  • 'key' - the name of the cookie to store the csrf crumb in (defaults to 'crumb')
  • 'size' - the length of the crumb to generate (defaults to 43, which is 256 bits, see cryptile for more information)
  • 'autoGenerate' - whether to automatically generate a new crumb for requests (defaults to true)
  • 'addToViewContext' - whether to automatically add the crumb to view contexts as the given key (defaults to true)
  • 'cookieOptions' - storage options for the cookie containing the crumb, see the server.state documentation of hapi for more information
  • 'restful' - RESTful mode that validates crumb tokens from "X-CSRF-Token" request header for POST, PUT, PATCH and DELETE server routes. Disables payload/query crumb validation (defaults to false)
  • 'skip' - a function with the signature of function (request, reply) {}, which when provided, is called for every request. If the provided function returns true, validation and generation of crumb is skipped (defaults to false)

Additionally, some configuration can be passed on a per-route basis

  • 'key' - the key used in the view contexts and payloads for the crumb (defaults to whatever the key value in the main settings is)
  • 'source' - can be either 'payload' or 'query' specifying how the crumb will be sent in requests (defaults to payload)
  • 'restful' - an override for the server's 'restful' setting (defaults to match server setting)

Keywords

FAQs

Last updated on 30 Mar 2016

Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc