[Replacement]: replace csurf

[mcollina]

Package to replace

csurf

Suggested replacement(s)

I don't have a good list to recommend at this point. For fastify we have https://github.com/fastify/csrf-protection.

Manifest type

preferred (lighter or more modern alternative package)

Rationale

500k weekly downloads for something that should protect security, but it doesn't because it's deprecated. This is scary.

Availability

No response

Code example (optional)

[bjohansebas]

We deprecated that package because we simply didn't have the bandwidth to maintain it. 🙂

Another option would be

https://www.npmjs.com/package/csrf-sync
https://www.npmjs.com/package/csrf-csrf

[joaopedrodcf]

Adding npmx links to thread to make it more easy to check packages and their deps,etc

To replace: https://npmx.dev/package/csurf

Possible replcaments:
https://npmx.dev/package/@fastify/csrf-protection
https://npmx.dev/package/csrf-sync
https://npmx.dev/package/csrf-csrf

[43081j]

is it still a necessary thing?

i wonder if we're better off creating an ecosystem-issues issue to track removing it from those packages that still have it installed.

does it need an equivalent or is there a better approach these days?