Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: safe defaults #26

Merged
merged 5 commits into from Dec 11, 2020
Merged

feat: safe defaults #26

merged 5 commits into from Dec 11, 2020

Conversation

simoneb
Copy link
Contributor

@simoneb simoneb commented Dec 9, 2020 •
edited

This PR includes several changes to make the plugin more secure by default. Some of them are breaking:

  • allow providing options to the csrf package in order to customize the length of the secret and the salt
  • BREAKING: remove support for extracting the token from the query, because insecure (can still be customized by providing a custom getToken option)
  • BREAKING: generated cookies are now httpOnly by default
  • added disclaimer to doc suggesting to accompany this plugin with fastify-helmet

Checklist

@simoneb simoneb marked this pull request as ready for review December 9, 2020 14:01
salmanm
salmanm approved these changes Dec 10, 2020
View reviewed changes
Copy link
Member

@salmanm salmanm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

delvedor
delvedor approved these changes Dec 11, 2020
View reviewed changes
Copy link
Member

@delvedor delvedor left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

mcollina
mcollina approved these changes Dec 11, 2020
View reviewed changes
Copy link
Member

@mcollina mcollina left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@mcollina mcollina merged commit 3c9de36 into fastify:master Dec 11, 2020
@mcollina mcollina deleted the feat/safe-defaults branch December 11, 2020 12:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mcollina mcollina mcollina approved these changes

@salmanm salmanm salmanm approved these changes

@delvedor delvedor delvedor approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@simoneb @mcollina @salmanm @delvedor