{"bugs":{"url":"https://github.com/hapijs/crumb/issues"},"dist":{"shasum":"40350bd9ea53a55cba508c74857fc587eb65baf1","tarball":"https://registry.npmjs.org/crumb/-/crumb-6.1.0.tgz","fileCount":14,"integrity":"sha512-SnaDR8nVUTYSmRsX54LgZxPszCQDpWVn49XPsfg+l1Gb+lHSxYfphdrUuh+hXxWv41RZJvzkEcNu9qt4xBjoAA==","signatures":[{"sig":"MEYCIQC6IwU+dkxpMuPChe/waozuzCmQeGV/GONKLTtGRotf6QIhAN2vtGw9pHf6oFvvVAr5lXdwOyMZ4X0t77c542KpqY18","keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA"}],"unpackedSize":109117,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJa3ft8CRA9TVsSAnZWagAAm3oP/jk+RDelilwvsbladDdF\nfQGDAPJP7IQrxkAClsCehNKnhH7XK/uHS6LvAHUdnTxEgvHkk0WBlNTAIblY\nAt75GAqmmf4x0TcgK/SBamCApmeDdcGvh0oS53bwd057I/Hy4o9CWhfVPkfY\n6+Zfg8YBNwxqxc697If4vwCp9dA+UYFX/ar+0jDmXcb9iTpQ9pidpLgQ8J4i\nvyBevlhVrJSQJZRsI7LxQmEkhNy0GwCcd9NhewIW9lZk/p4iVT1wwTnhoPhX\nTWWcpQ2jZb93L+4lp0O5QLZeOn+QRwmRQqA0e6H/i5XBGa/KmBT9q/F0w5Hx\nRLUZ4dHCYAs7dfEegQ+NlrF6eKqXWmgsze4ejaaeVM00ee1TDd62bTX7iyxx\n3RoBAC67Zhj5iTqjg94kKCFKgQ6wre7GLq+DIvGaRsOFrQro+6TkmPkp+VkQ\nLj4QupGoxJfstCe4ZiP6/8smTWl4PKRFxIXtgcrT52KFJqjZR6KAE6G4xKRP\nUB40issl5ftVetMCjdxmXqsi88JII8sFGihxwYpAkcBhdVuBgcVzeIPi9EX/\nE19xz6mfLYoeUcb6rquf98fyQpZ/v3Zes0VRFzQs4HSz0IyeTtJDRoqnxi1D\nth4cVdgGzlt7lIH1AtygrSFyLI8UaGZVExqrUBl1CKk+HLKf3Vxz/J3SJYDt\nEYfc\r\n=mSTc\r\n-----END PGP SIGNATURE-----\r\n"},"main":"lib/index.js","name":"crumb","readme":"![crumb Logo](https://raw.github.com/hapijs/crumb/master/images/crumb.png)\n\nCSRF crumb generation and validation for [**hapi**](https://github.com/hapijs/hapi)\n\n[![Build Status](https://secure.travis-ci.org/hapijs/crumb.png)](http://travis-ci.org/hapijs/crumb)\n\nLead Maintainer: [Marcus Stong](https://github.com/stongo)\n\n## What to Use Crumb for and When to Use It\n\nCrumb is used to diminish CSRF attacks using a random unique token that is validated on the server side.\n\nCrumb may be used whenever you want to prevent malicious code to execute system commands, that are performed by HTTP requests. For example, if users are able to publish code on your website, malicious code added by a user could force every other user who opens the page, to load and execute code from a third party website e.g. via an HTML image tag. With Crumb implemented into your hapi.js application, you are able to verify requests with unique tokens and prevent the execution of malicious requests. \n\n## CORS\n\nCrumb has been refactored to securely work with CORS, as [OWASP](https://www.owasp.org/index.php/HTML5_Security_Cheat_Sheet#Cross_Origin_Resource_Sharing) recommends using CSRF protection with CORS.\n\n**It is highly discouraged to have a production servers `cors.origin` setting set to \"[\\*]\" or \"true\" with Crumb as it will leak the crumb token to potentially malicious sites**\n\n\n\n## Plugin Options\n\nThe following options are available when registering the plugin\n\n* 'key' - the name of the cookie to store the csrf crumb in (defaults to 'crumb')\n* 'size' - the length of the crumb to generate (defaults to 43, which is 256 bits, see [cryptile](https://github.com/hueniverse/cryptiles) for more information)\n* 'autoGenerate' - whether to automatically generate a new crumb for requests (defaults to true)\n* 'addToViewContext' - whether to automatically add the crumb to view contexts as the given key (defaults to true)\n* 'cookieOptions' - storage options for the cookie containing the crumb, see the [server.state](http://hapijs.com/api#serverstatename-options) documentation of hapi for more information\n* 'restful' - RESTful mode that validates crumb tokens from \"X-CSRF-Token\" request header for POST, PUT, PATCH and DELETE server routes. Disables payload/query crumb validation (defaults to false)\n* 'skip' - a function with the signature of `function (request, reply) {}`, which when provided, is called for every request. If the provided function returns true, validation and generation of crumb is skipped (defaults to false)\n* 'logUnauthorized' - whether to add to the request log with tag 'crumb' and data 'validation failed' (defaults to false)\n\nAdditionally, some configuration can be passed on a per-route basis\n\n* 'key' - the key used in the view contexts and payloads for the crumb (defaults to whatever the key value in the main settings is)\n* 'source' - can be either 'payload' or 'query' specifying how the crumb will be sent in requests (defaults to payload)\n* 'restful' - an override for the server's 'restful' setting (defaults to match server setting)\n","engines":{"node":">=4.0.0"},"gitHead":"301bfb9751c1fde3a1bfccf42c67ecacc2b824da","license":"BSD-3-Clause","scripts":{"test":"lab -r console -t 100 -a code -L","test-cov-html":"lab -r html -o coverage.html -a code -L"},"_npmUser":{"name":"wyatt","email":"wpreul@gmail.com"},"homepage":"https://github.com/hapijs/crumb#readme","keywords":["hapi","plugin","cookies","csrf","session"],"deprecated":"This module has moved and is now available at @hapi/crumb. Please update your dependencies as this version is no longer maintained an may contain bugs and security issues.","repository":{"url":"git://github.com/hapijs/crumb.git","type":"git"},"_npmVersion":"5.6.0","description":"CSRF crumb generation and validation plugin","directories":{},"maintainers":[{"name":"hueniverse","email":"eran@hammer.io"},{"name":"jonathansamines","email":"jn.samines@gmail.com"},{"name":"marsup","email":"nicolas@morel.io"},{"name":"nlf","email":"quitlahok@gmail.com"},{"name":"wyatt","email":"wpreul@gmail.com"}],"_nodeVersion":"8.11.1","dependencies":{"joi":"8.x.x","boom":"3.x.x","hoek":"4.x.x","cryptiles":"3.x.x"},"_hasShrinkwrap":false,"readmeFilename":"README.md","devDependencies":{"lab":"10.x.x","code":"2.x.x","hapi":"16.x.x","vision":"^4.0.0","handlebars":"^4.0.5"},"peerDependencies":{"hapi":">=12.x.x"},"_npmOperationalInternal":{"tmp":"tmp/crumb_6.1.0_1524497276521_0.8816106616480721","host":"s3://npm-registry-packages"},"_id":"crumb@6.1.0","version":"6.1.0"}