@remix-run/csrf-middleware 0.1.4 → 0.1.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +5 -12
- package/package.json +8 -8
package/README.md
CHANGED
|
@@ -74,18 +74,11 @@ For unsafe methods (`POST`, `PUT`, `PATCH`, `DELETE`), the middleware validates
|
|
|
74
74
|
|
|
75
75
|
## Why This Exists
|
|
76
76
|
|
|
77
|
-
Modern browsers now provide stronger cross-origin signals like `Sec-Fetch-Site`, and explicit
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
Remix cannot assume those guarantees for every app. `csrf()` still exists as the conservative
|
|
83
|
-
option for apps that want synchronizer tokens in addition to origin checks, especially for
|
|
84
|
-
session-backed HTML form workflows and mixed deployment environments.
|
|
85
|
-
|
|
86
|
-
If your deployment can guarantee the prerequisites for the tokenless model, this middleware is
|
|
87
|
-
optional. In that case, [`cop-middleware`](https://github.com/remix-run/remix/tree/main/packages/cop-middleware)
|
|
88
|
-
may be a better fit.
|
|
77
|
+
Modern browsers now provide stronger cross-origin signals like `Sec-Fetch-Site`, and explicit `SameSite=Lax` cookies already block many CSRF attacks. We have considered the lighter, tokenless model used by Go's `CrossOriginProtection`, and we think it is a good fit when a deployment can make all of the guarantees that model depends on.
|
|
78
|
+
|
|
79
|
+
Remix cannot assume those guarantees for every app. `csrf()` still exists as the conservative option for apps that want synchronizer tokens in addition to origin checks, especially for session-backed HTML form workflows and mixed deployment environments.
|
|
80
|
+
|
|
81
|
+
If your deployment can guarantee the prerequisites for the tokenless model, this middleware is optional. In that case, [`cop-middleware`](https://github.com/remix-run/remix/tree/main/packages/cop-middleware) may be a better fit.
|
|
89
82
|
|
|
90
83
|
## Related Packages
|
|
91
84
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@remix-run/csrf-middleware",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.6",
|
|
4
4
|
"description": "Middleware for CSRF protection in Fetch API servers",
|
|
5
5
|
"author": "Michael Jackson <mjijackson@gmail.com>",
|
|
6
6
|
"license": "MIT",
|
|
@@ -28,16 +28,16 @@
|
|
|
28
28
|
"devDependencies": {
|
|
29
29
|
"@types/node": "^24.6.0",
|
|
30
30
|
"@typescript/native-preview": "7.0.0-dev.20251125.1",
|
|
31
|
-
"@remix-run/
|
|
32
|
-
"@remix-run/
|
|
33
|
-
"@remix-run/cookie": "0.5.3",
|
|
31
|
+
"@remix-run/cookie": "0.5.4",
|
|
32
|
+
"@remix-run/fetch-router": "0.20.0",
|
|
34
33
|
"@remix-run/session": "0.4.2",
|
|
35
|
-
"@remix-run/
|
|
36
|
-
"@remix-run/session-middleware": "0.3.
|
|
37
|
-
"@remix-run/test": "0.
|
|
34
|
+
"@remix-run/assert": "0.3.0",
|
|
35
|
+
"@remix-run/session-middleware": "0.3.3",
|
|
36
|
+
"@remix-run/test": "0.5.0",
|
|
37
|
+
"@remix-run/form-data-middleware": "0.3.3"
|
|
38
38
|
},
|
|
39
39
|
"dependencies": {
|
|
40
|
-
"@remix-run/fetch-router": "^0.
|
|
40
|
+
"@remix-run/fetch-router": "^0.20.0",
|
|
41
41
|
"@remix-run/session": "^0.4.2"
|
|
42
42
|
},
|
|
43
43
|
"keywords": [
|