Uploaded image for project: 'OpenShift Service Mesh'
  1. OpenShift Service Mesh
  2. OSSM-6613

CSRF protection is disabled for your Express app.

XMLWordPrintable

    • False
    • Hide

      None

      Show
      None
    • False

       In router.test 

      app = express().use(router);
      CSRF protection is disabled for your Express app. This allows the attackers to execute requests on a user's behalf.

      how fix it

      also same line

      Disable X-Powered-By header for your Express app (consider using Helmet middleware), because it exposes information about the used framework to potential attackers.

              rh-ee-jcordoba Josune Cordoba Torrecilla
              agutierr@redhat.com Alberto Jesus Gutierrez Juanes
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: