CSRF crumb generation and validation plugin

npm install crumb
2 downloads in the last day
8 downloads in the last week
83 downloads in the last month

crumb Logo

CSRF crumb generation and validation for hapi

Build Status

The following options are available when registering the plugin

  • 'key' - the name of the cookie to store the csrf crumb in (defaults to 'crumb')
  • 'size' - the length of the crumb to generate (defaults to 43, which is 256 bits, see cryptile for more information)
  • 'autoGenerate' - whether to automatically generate a new crumb for requests (defaults to true)
  • 'addToViewContext' - whether to automatically add the crumb to view contexts as the given key (defaults to true)
  • 'cookieOptions' - storage options for the cookie containing the crumb, see the server.state documentation of hapi for more information
  • 'restful' - RESTful mode that validates crumb tokens from "X-CSRF-Token" request header for POST, PUT, PATCH and DELETE server routes. Disables payload/query crumb validation (defaults to false)

Additionally, some configuration can be passed on a per-route basis

  • 'key' - the key used in the view contexts and payloads for the crumb (defaults to whatever the key value in the main settings is)
  • 'source' - can be either 'payload' or 'query' specifying how the crumb will be sent in requests (defaults to payload)
  • 'restful' - an override for the server's 'restful' setting (defaults to match server setting)
npm loves you