Setting `plugins.crumb: false` on a route does not disable crumb validation
- Dominant language
- JavaScript
- Stars
- 170
- Forks
- 47
- PR merge metrics
- No merged PRs in 30d
Description
### Runtime
node.js
### Runtime version
20
### Module version
9.0.1
### Last module version without issue
_No response_
### Used with
hapi
### Any other relevant information
From [the documentation](https://hapi.dev/module/crumb/api/?v=9.0.1#:~:text=Additionally%2C%20some%20configuration%20can%20be%20passed%20on%20a%20per%2Droute%20basis.%20Disable%20Crumb%20for%20a%20particular%20route%20by%20passing%20false%20instead%20of%20a%20configuration%20object.):
> Additionally, some configuration can be passed on a per-route basis. Disable Crumb for a particular route by passing false instead of a configuration object.
This test case verifies the expected behaviour with regards to setting `route.options.plugins.crumb: false`:
```
it('does not validate crumb when route.options.plugins.crumb is false', async () => {
const server = Hapi.server();
server.route({
method: 'POST',
path: '/1',
options: {
plugins: {
crumb: false
}
},
handler: (request, h) => 'test'
});
const plugins = [
{
plugin: Crumb,
}
];
await server.register(plugins);
const headers = {
'X-API-Token': 'test'
};
const res = await server.inject({
method: 'POST',
url: '/1',
headers
});
const header = res.headers['set-cookie'];
expect(res.statusCode).to.equal(200);
expect(header).to.not.exist();
});
```
### What are you trying to achieve or the steps to reproduce?
I want to disable crumb validation/generation for a specific route, without using the `skip` option (to keep concerns separated). I therefore set `route.options.plugins.crumb: false` as suggested by the documentation.
### What was the result you got?
The crumb validation runs and a new cookie value is returned.
### What result did you expect?
The crumb validation should not run, no cookie should be set.
Contributor guide
Assessment
This issue has not been assessed yet.