lusca
lusca copied to clipboard
krakenjs
Application security for express apps.
Bumps [minimatch](https://github.com/isaacs/minimatch) to 3.0.8 and updates ancestor dependencies [minimatch](https://github.com/isaacs/minimatch), grunt and grunt-mocha-test. These dependencies need to be updated together. Updates `minimatch` from 0.2.14 to 3.0.8 Commits 782c264 3.0.8 6ade2da fix:...
![dependabot[bot] avatar](https://avatars.githubusercontent.com/in/29110?v=4 "dependabot[bot] avatar"){kind=avatar}
When a URL is added to be bypassed, CSRF is not set in the response which leads to subsequent POST requests throwing a 403. This change sets the CSRF token...
Bumps [path-parse](https://github.com/jbgutierrez/path-parse) from 1.0.6 to 1.0.7. Commits See full diff in compare view [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter...
As you know, Google Chrome Developers disabled XSS Auditor. Developers should be able to disable the auditor for older browsers and set it to 0. The `x-xss-protection` header was found...
Bumps [cli](https://github.com/node-js-libs/cli) from 0.4.5 to 1.0.1. Commits 470db35 1.0.1 ae103f8 Update glob, closes #91 969a1e5 1.0.0 ed90515 Merge pull request #86 from jugglinmike/remove-daemon fd6bc4d Remove daemon support 9f4c00b Merge pull...
Hi. It seems like for end points that are blacklisted by Lusca, it does not set CSRF tokens for the requests at all. So what can happen is for the...
The documentation for lusca.csp says this: `options.scriptNonce Boolean - Enable nonce for inline script-src, access from res.locals.nonce` Which, to me, sounds like lusca would generate the nonces it self. I...
Hello Team, Based on the [README](https://github.com/krakenjs/lusca#luscaxframevalue), it's recommended to use `ALLOW-FROM URI` but [MDN docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options) recommend not to use it as its obsolete and is not supported in a modern...
