Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Adding basic crumb CSRF information to reference guide #607

Merged
merged 2 commits into from
Mar 1, 2013
Merged

Adding basic crumb CSRF information to reference guide #607

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2fd2e9e
Adding CSRF section
geek Feb 28, 2013
47649d0
Update Reference.md
geek Feb 28, 2013
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions docs/Reference.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,7 @@
- [**Server Helpers**](#server-helpers)
<p></p>
- [**Server Plugins**](#server-plugins)
- [CSRF Protection](#csrf-protection)
- [Documentation Generator](#documentation-generator)

## Server Construction
Expand Down Expand Up @@ -1705,6 +1706,19 @@ http.route({

# Server Plugins

## CSRF Protection

In order to help mitigate CSRF threats there is a plugin for **hapi** called [crumb](https://npmjs.org/package/crumb) that can be installed. Install **crumb** by either running `npm install crumb` in your sites working directory or add _'crumb'_ to the dependencies section of the _'package.json'_ file and run `npm install`.

The following plugin options are available for **crumb**
- `name` - name of cookie to store crumb. Default is 'crumb'.
- `size` - number of characters to randomly generate for crumb value. Default is '43'.
- `autoGenerate` - bool value to indicate if the crumb should be created automatically. Default is 'true'.
- `addToViewContext` - bool value to indicate if crumb is added to the context of a view before the context is bound (making it accessible in a template). Default is 'true'.
- `cookieOptions`
- `path` - cookie path to restrict access to crumb cookie. Default is '/'.


## Documentation Generator

**This is an experimental feature and is likely to change!**
Expand Down