Psifi-Solutions / csrf-csrf / 14918234982

100%

push

github

fix: when validateOnReuse was false, behaviour was incorrect

Prior to this fix, if you set validateOnReuse to false, this only
prevented the error from being thrown, it did not actually
prevent validation from happening. This means if you were to
make a GET request without including the token in the request
and you were hoping to have the existing CSRF token included
in the response, it wasn't really possible, a new one would be
generated every time. It should not be necessary to included
the CSRF token in GET requests.

Now when validateOnReuse is false, the existing CSRF token
will be reused from the CSRF token cookie, without prior
validation. This is a semi breaking change, but it is a correction
of expected behaviour.

56 of 56 branches covered (100.0%)

Branch coverage included in aggregate %.

2 of 2 new or added lines in 1 file covered. (100.0%)

57 of 57 relevant lines covered (100.0%)

90.23 hits per line