veryfront 0.1.749 → 0.1.750

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.749",
+    "version": "0.1.750",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "minimumDependencyAge": "P2D",

package/esm/src/config/schemas/config.schema.d.ts

@@ -110,7 +110,7 @@ export declare const getVeryfrontConfigSchema: () => import("../../internal-agen
          * Set `true` for defaults, or pass an object to customize.
          *
          * When enabled, POST/PUT/PATCH/DELETE requests must include
-         * an `x-csrf-token` header matching the `vf_csrf` cookie.
+         * an `x-csrf-token` header matching the `__Host-vf_csrf` cookie.
          * The cookie is set automatically on HTML document responses.
          *
          * Server Actions (`/_veryfront/rsc/action`) are CSRF-protected;
@@ -508,7 +508,7 @@ export declare const veryfrontConfigSchema: import("../../internal-agents/schema
          * Set `true` for defaults, or pass an object to customize.
          *
          * When enabled, POST/PUT/PATCH/DELETE requests must include
-         * an `x-csrf-token` header matching the `vf_csrf` cookie.
+         * an `x-csrf-token` header matching the `__Host-vf_csrf` cookie.
          * The cookie is set automatically on HTML document responses.
          *
          * Server Actions (`/_veryfront/rsc/action`) are CSRF-protected;

package/esm/src/config/schemas/config.schema.js

@@ -161,7 +161,7 @@ export const getVeryfrontConfigSchema = defineSchema((v) => v
          * Set `true` for defaults, or pass an object to customize.
          *
          * When enabled, POST/PUT/PATCH/DELETE requests must include
-         * an `x-csrf-token` header matching the `vf_csrf` cookie.
+         * an `x-csrf-token` header matching the `__Host-vf_csrf` cookie.
          * The cookie is set automatically on HTML document responses.
          *
          * Server Actions (`/_veryfront/rsc/action`) are CSRF-protected;

package/esm/src/security/csrf/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/src/security/csrf/helpers.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,UAAU;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mFAAmF;IACnF,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,wEAAwE;AACxE,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAeA;AAmBD,yDAAyD;AACzD,wBAAgB,YAAY,CAC1B,GAAG,EAAE,OAAO,EACZ,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACrD,OAAO,CAiBT;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,OAAO,EACZ,eAAe,EAAE,OAAO,EACxB,UAAU,CAAC,EAAE,OAAO,GAAG,UAAU,GAChC,IAAI,CAyCN"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/src/security/csrf/helpers.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,UAAU;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mFAAmF;IACnF,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,wEAAwE;AACxE,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAeA;AAmBD,yDAAyD;AACzD,wBAAgB,YAAY,CAC1B,GAAG,EAAE,OAAO,EACZ,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACrD,OAAO,CAiBT;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,OAAO,EACZ,eAAe,EAAE,OAAO,EACxB,UAAU,CAAC,EAAE,OAAO,GAAG,UAAU,GAChC,IAAI,CA0CN"}

package/esm/src/security/csrf/helpers.js

@@ -11,12 +11,13 @@ import { base64urlEncodeBytes } from "../../utils/base64url.js";
 import { parseCookiesFromHeaders } from "../../utils/cookie-utils.js";
 /** Default CSRF token TTL: 24 hours (longer than session action TTL to avoid stale-form 403s). */
 const CSRF_DEFAULT_TTL_SEC = 86_400;
+const DEFAULT_CSRF_COOKIE_NAME = "__Host-vf_csrf";
 /** Generate a CSRF token and return value + Set-Cookie header string */
 export function generateCsrfToken(options) {
-    const cookieName = options?.cookieName ?? "vf_csrf";
+    const cookieName = options?.cookieName ?? DEFAULT_CSRF_COOKIE_NAME;
     const maxAge = options?.ttlSec ?? CSRF_DEFAULT_TTL_SEC;
     const httpOnly = options?.httpOnly ?? true;
-    const secure = options?.secure ?? true;
+    const secure = cookieName.startsWith("__Host-") ? true : options?.secure ?? true;
     const bytes = new Uint8Array(32);
     dntShim.crypto.getRandomValues(bytes);
     const token = base64urlEncodeBytes(bytes);
@@ -44,7 +45,7 @@ function timingSafeEqual(a, b) {
 }
 /** Validate CSRF token by comparing header and cookie */
 export function validateCsrf(req, options) {
-    const cookieName = options?.cookieName ?? "vf_csrf";
+    const cookieName = options?.cookieName ?? DEFAULT_CSRF_COOKIE_NAME;
     const headerName = options?.headerName ?? "x-csrf-token";
     let cookieToken;
     try {
@@ -83,7 +84,7 @@ export function applyCsrfCookie(req, responseHeaders, csrfConfig) {
         return;
     }
     const config = typeof csrfConfig === "boolean" ? {} : csrfConfig;
-    const cookieName = config.cookieName ?? "vf_csrf";
+    const cookieName = config.cookieName ?? DEFAULT_CSRF_COOKIE_NAME;
     // Skip if cookie already present in request
     let cookies;
     try {
@@ -96,7 +97,8 @@ export function applyCsrfCookie(req, responseHeaders, csrfConfig) {
     if (cookies[cookieName])
         return;
     // Detect HTTPS from request URL or forwarded proto
-    const isSecure = req.url.startsWith("https://") ||
+    const isSecure = cookieName.startsWith("__Host-") ||
+        req.url.startsWith("https://") ||
         req.headers.get("x-forwarded-proto") === "https";
     const { setCookie } = generateCsrfToken({
         cookieName,

package/esm/src/security/http/csrf/csrf-handler.d.ts

@@ -10,7 +10,7 @@
  * are **not** exempt and require a valid CSRF token. Client-side code that calls
  * Server Actions must:
  *
- * 1. Read the `vf_csrf` cookie (set automatically on HTML responses)
+ * 1. Read the `__Host-vf_csrf` cookie (set automatically on HTML responses)
  * 2. Include it as the `x-csrf-token` request header on every POST
  *
  * Example (client-side fetch wrapper):
@@ -21,7 +21,7 @@
  *
  * const res = await fetch("/_veryfront/rsc/action", {
  *   method: "POST",
- *   headers: { "x-csrf-token": getCookie("vf_csrf") ?? "" },
+ *   headers: { "x-csrf-token": getCookie("__Host-vf_csrf") ?? "" },
  *   body: actionPayload,
  * });
  * ```

package/esm/src/security/http/csrf/csrf-handler.js

@@ -10,7 +10,7 @@
  * are **not** exempt and require a valid CSRF token. Client-side code that calls
  * Server Actions must:
  *
- * 1. Read the `vf_csrf` cookie (set automatically on HTML responses)
+ * 1. Read the `__Host-vf_csrf` cookie (set automatically on HTML responses)
  * 2. Include it as the `x-csrf-token` request header on every POST
  *
  * Example (client-side fetch wrapper):
@@ -21,7 +21,7 @@
  *
  * const res = await fetch("/_veryfront/rsc/action", {
  *   method: "POST",
- *   headers: { "x-csrf-token": getCookie("vf_csrf") ?? "" },
+ *   headers: { "x-csrf-token": getCookie("__Host-vf_csrf") ?? "" },
  *   body: actionPayload,
  * });
  * ```

package/esm/src/utils/version-constant.d.ts

@@ -1,3 +1,3 @@
 /** Shared version value. */
-export declare const VERSION = "0.1.749";
+export declare const VERSION = "0.1.750";
 //# sourceMappingURL=version-constant.d.ts.map

package/esm/src/utils/version-constant.js

@@ -1,4 +1,4 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
 /** Shared version value. */
-export const VERSION = "0.1.749";
+export const VERSION = "0.1.750";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.749",
+  "version": "0.1.750",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",