Comments (10)
Hi @ForbesLindesay would you be able to share your code, or a skeleton that illustrates the issue? I don't have any working examples currently which I can use to reproduce this.
EDIT: Nevermind, I can reproduce this quite simply. Just didn't think it through far enough. Will get back to this issue with a resolution asap
from lusca.
We might want to consider changing the default, but the key
is configuration in 1.x
. See https://github.com/krakenjs/lusca#luscacsrfoptions
from lusca.
The key in question here isn't the key used to get the value off the request, but instead the one used to store the token in the user's current session.
from lusca.
I created this sample express app which can be used to reproduce the issue:
https://gist.github.com/grawk/af976c29fedfb6602db1
app.use(lusca({
csrf: true
}));
can be replaced with this, and used with my master branch to illustrate the fix
app.use(lusca({
csrf: {secret: 'shhCsrf'}
}));
from lusca.
Ah, my fault. I probably should have clicked on the first link in @ForbesLindesay's message 😄
from lusca.
I just ran into this problem when experimenting with switching between express-session and cookie-session. I personally think this is something that the cookie-session module should fix (allow things that start with "_") but it'd also be nice to be able to configure the session key.
Update: I just heard back from cookie-session and they'll be supporting "_" in 2.0. Doesn't help in the short-term though unfortunately.
from lusca.
Currently have a PR open to resolve the issue of lusca working with express-session pre "_" fix. It is being considered along with some other changes to lusca. Will update once released.
from lusca.
Looks like this change has been merged into the master branch; however, there is no tag for it yet. Any idea when it will be tagged and released?
from lusca.
Thanks for the bump @amityb I'll try and usher this through and tag it asap
from lusca.
#40 is the version bump with this change. Also note that [email protected] is now published
from lusca.
Related Issues (20)
- CSRF error status code HOT 3
- csrf http2 token validation fails while http1 passes HOT 2
- Exempting XSRF-TOKEN for some requests HOT 2
- Support CSRF black/white listing on URL params HOT 2
- X-XSS-Protection report uri HOT 1
- How to send post with CSRF token without manually adding a form or whitelisting/blacklisting HOT 2
- Is helmet needed with lusca? HOT 2
- CSRF blacklist and whitelist not working as expected for multiple endpoints. HOT 1
- DNS Rebinding protection
- lusca requires req.session
- How skip api css js avoid redundant?
- CSRF token missing at app.use(lusca.csrf())
- Nonce is not being generated HOT 2
- CSP policy is wrong when whitespace is missing before 'self'
- Change CSRF-Token name
- Cookie “XSRF-TOKEN” will be soon rejected HOT 1
- lusca.xframe value - "ALLOW-FROM uri" is obselete
- Setting CSRF token on the blacklisted routes.
- Rename csrf blacklist/whitelist configs HOT 1
- CSRF token is mismatch even in correct things. HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from lusca.