@remix-run/csrf-middleware 0.1.4 → 0.1.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +5 -12
  2. package/package.json +8 -8
package/README.md CHANGED
@@ -74,18 +74,11 @@ For unsafe methods (`POST`, `PUT`, `PATCH`, `DELETE`), the middleware validates
74
74
 
75
75
  ## Why This Exists
76
76
 
77
- Modern browsers now provide stronger cross-origin signals like `Sec-Fetch-Site`, and explicit
78
- `SameSite=Lax` cookies already block many CSRF attacks. We have considered the lighter,
79
- tokenless model used by Go's `CrossOriginProtection`, and we think it is a good fit when a
80
- deployment can make all of the guarantees that model depends on.
81
-
82
- Remix cannot assume those guarantees for every app. `csrf()` still exists as the conservative
83
- option for apps that want synchronizer tokens in addition to origin checks, especially for
84
- session-backed HTML form workflows and mixed deployment environments.
85
-
86
- If your deployment can guarantee the prerequisites for the tokenless model, this middleware is
87
- optional. In that case, [`cop-middleware`](https://github.com/remix-run/remix/tree/main/packages/cop-middleware)
88
- may be a better fit.
77
+ Modern browsers now provide stronger cross-origin signals like `Sec-Fetch-Site`, and explicit `SameSite=Lax` cookies already block many CSRF attacks. We have considered the lighter, tokenless model used by Go's `CrossOriginProtection`, and we think it is a good fit when a deployment can make all of the guarantees that model depends on.
78
+
79
+ Remix cannot assume those guarantees for every app. `csrf()` still exists as the conservative option for apps that want synchronizer tokens in addition to origin checks, especially for session-backed HTML form workflows and mixed deployment environments.
80
+
81
+ If your deployment can guarantee the prerequisites for the tokenless model, this middleware is optional. In that case, [`cop-middleware`](https://github.com/remix-run/remix/tree/main/packages/cop-middleware) may be a better fit.
89
82
 
90
83
  ## Related Packages
91
84
 
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@remix-run/csrf-middleware",
3
- "version": "0.1.4",
3
+ "version": "0.1.5",
4
4
  "description": "Middleware for CSRF protection in Fetch API servers",
5
5
  "author": "Michael Jackson <mjijackson@gmail.com>",
6
6
  "license": "MIT",
@@ -29,15 +29,15 @@
29
29
  "@types/node": "^24.6.0",
30
30
  "@typescript/native-preview": "7.0.0-dev.20251125.1",
31
31
  "@remix-run/assert": "0.2.1",
32
- "@remix-run/form-data-middleware": "0.3.1",
33
- "@remix-run/cookie": "0.5.3",
34
- "@remix-run/session": "0.4.2",
35
- "@remix-run/fetch-router": "0.19.1",
36
- "@remix-run/session-middleware": "0.3.1",
37
- "@remix-run/test": "0.4.1"
32
+ "@remix-run/cookie": "0.5.4",
33
+ "@remix-run/fetch-router": "0.19.2",
34
+ "@remix-run/form-data-middleware": "0.3.2",
35
+ "@remix-run/test": "0.4.2",
36
+ "@remix-run/session-middleware": "0.3.2",
37
+ "@remix-run/session": "0.4.2"
38
38
  },
39
39
  "dependencies": {
40
- "@remix-run/fetch-router": "^0.19.1",
40
+ "@remix-run/fetch-router": "^0.19.2",
41
41
  "@remix-run/session": "^0.4.2"
42
42
  },
43
43
  "keywords": [