@constructive-io/csrf 0.30.0 → 0.31.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/esm/middleware.js +2 -1
- package/esm/types.d.ts +1 -0
- package/middleware.js +2 -1
- package/package.json +2 -2
- package/types.d.ts +1 -0
package/README.md
CHANGED
|
@@ -107,7 +107,7 @@ const csrf = createCsrfMiddleware({
|
|
|
107
107
|
httpOnly: true, // Not accessible via JavaScript
|
|
108
108
|
secure: true, // HTTPS only in production
|
|
109
109
|
sameSite: 'lax', // CSRF protection
|
|
110
|
-
maxAge: 86400,
|
|
110
|
+
maxAge: 86400 * 1000, // 24 hours, in milliseconds (Express `res.cookie` unit)
|
|
111
111
|
path: '/',
|
|
112
112
|
},
|
|
113
113
|
});
|
package/esm/middleware.js
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { generateToken, verifyToken } from './token';
|
|
2
2
|
import { createCsrfError } from './types';
|
|
3
|
+
const DEFAULT_MAX_AGE_MS = 24 * 60 * 60 * 1000;
|
|
3
4
|
const DEFAULT_CONFIG = {
|
|
4
5
|
cookieName: 'csrf_token',
|
|
5
6
|
headerName: 'x-csrf-token',
|
|
@@ -8,7 +9,7 @@ const DEFAULT_CONFIG = {
|
|
|
8
9
|
httpOnly: true,
|
|
9
10
|
secure: process.env.NODE_ENV === 'production',
|
|
10
11
|
sameSite: 'lax',
|
|
11
|
-
maxAge:
|
|
12
|
+
maxAge: DEFAULT_MAX_AGE_MS,
|
|
12
13
|
path: '/',
|
|
13
14
|
},
|
|
14
15
|
ignoreMethods: ['GET', 'HEAD', 'OPTIONS'],
|
package/esm/types.d.ts
CHANGED
|
@@ -10,6 +10,7 @@ export interface CookieOptions {
|
|
|
10
10
|
httpOnly?: boolean;
|
|
11
11
|
secure?: boolean;
|
|
12
12
|
sameSite?: 'strict' | 'lax' | 'none';
|
|
13
|
+
/** Cookie lifetime in milliseconds (passed to Express `res.cookie`, which emits `Max-Age` in seconds). */
|
|
13
14
|
maxAge?: number;
|
|
14
15
|
path?: string;
|
|
15
16
|
domain?: string;
|
package/middleware.js
CHANGED
|
@@ -4,6 +4,7 @@ exports.createCsrfMiddleware = createCsrfMiddleware;
|
|
|
4
4
|
exports.csrfErrorHandler = csrfErrorHandler;
|
|
5
5
|
const token_1 = require("./token");
|
|
6
6
|
const types_1 = require("./types");
|
|
7
|
+
const DEFAULT_MAX_AGE_MS = 24 * 60 * 60 * 1000;
|
|
7
8
|
const DEFAULT_CONFIG = {
|
|
8
9
|
cookieName: 'csrf_token',
|
|
9
10
|
headerName: 'x-csrf-token',
|
|
@@ -12,7 +13,7 @@ const DEFAULT_CONFIG = {
|
|
|
12
13
|
httpOnly: true,
|
|
13
14
|
secure: process.env.NODE_ENV === 'production',
|
|
14
15
|
sameSite: 'lax',
|
|
15
|
-
maxAge:
|
|
16
|
+
maxAge: DEFAULT_MAX_AGE_MS,
|
|
16
17
|
path: '/',
|
|
17
18
|
},
|
|
18
19
|
ignoreMethods: ['GET', 'HEAD', 'OPTIONS'],
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@constructive-io/csrf",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.31.0",
|
|
4
4
|
"author": "Constructive <developers@constructive.io>",
|
|
5
5
|
"description": "CSRF protection utilities for Express applications",
|
|
6
6
|
"main": "index.js",
|
|
@@ -24,5 +24,5 @@
|
|
|
24
24
|
"makage": "^0.8.0",
|
|
25
25
|
"ts-node": "^10.9.2"
|
|
26
26
|
},
|
|
27
|
-
"gitHead": "
|
|
27
|
+
"gitHead": "487c4ec9ee997d7da80584a3d41d7120d4354c54"
|
|
28
28
|
}
|
package/types.d.ts
CHANGED
|
@@ -10,6 +10,7 @@ export interface CookieOptions {
|
|
|
10
10
|
httpOnly?: boolean;
|
|
11
11
|
secure?: boolean;
|
|
12
12
|
sameSite?: 'strict' | 'lax' | 'none';
|
|
13
|
+
/** Cookie lifetime in milliseconds (passed to Express `res.cookie`, which emits `Max-Age` in seconds). */
|
|
13
14
|
maxAge?: number;
|
|
14
15
|
path?: string;
|
|
15
16
|
domain?: string;
|