fusionjs/fusion-plugin-csrf-protection

Migrated to https://github.com/fusionjs/fusionjs

fusion-plugin-csrf-protection's Issues

Add Token dependencies to readme

Problem/Rationale

Documentation regarding Fusion API is out of date given recent changes to leverage new Dependency Injection architecture.

Solution/Change/Deliverable

Update documentation

Allow CSRF forms

Type of issue

Feature request

Description

It would be nice for form submits to be able to leverage CSRF protection. This doesn't seem included in the library as is right now.

Current behavior

Can only use CSRF for fetch calls

Expected behavior

Ability to add csrf-token field to forms

Remove csrf endpoint once clients have time to upgrade

After simplifying the plugin we can now remove the csrf endpoint. However, we should wait some time for clients to have time to upgrade.

Expose {ignore, fetch} as instance methods rather than static

I don't think there is any reason to expose them as static rather than instance methods. Exposing as instance methods makes the api more consistent with other plugins we have.

Add Token dependencies to readme

Problem/Rationale

Documentation regarding Fusion API (core; plugins; cli; etc.) is out of date given recent changes to leverage new Dependency Injection architecture.

Solution/Change/Deliverable

Update documentation

Migrate to new fusion-tokens api

Don't include url prefix if it's already included

Use `ctx.throw` to handle csrf errors

Add initial implementation

Use Buildkite for CI

Fix flow types

Add LICENSE

Update dependencies

Migrate fusion-plugin-csrf-protection to DI

Dependency deprecation warning: generic-session (npm)

On registry https://registry.yarnpkg.com/, the "latest" version (v0.1.2) of dependency generic-session has the following deprecation notice:

no longer maintained

Marking the latest version of an npm package as deprecated results in the entire package being considered deprecated, so contact the package author you think this is a mistake.

Affected package file(s): package.json

If you don't care about this, you can close this issue and not be warned about generic-session's deprecation again. If you would like to completely disable all future deprecation warnings then add the following to your config:

"suppressNotifications": ["deprecationWarningIssues"]

Clean up API