forms.js

ABOUT

This module is concerned with the generation of secure forms and validation of data collected by forms

REQUIREMENTS & ASSUMPTIONS

require('../security.json')

AVAILABLE METHODS

Module Instantiation

method name description params returns
N/A returns values for autocomplete, method and _csrf token request, response Http, callback function form configurations or Error

USAGE

// where security = require('security')
app.get('/next', function (request, response, next) {
  let form = security.forms
  form(request, response, function (err) {
    if (err) {
      next(err)
    } else {
      response.send(`<form action='/next' method="${security.forms.method} 
                      autocomplete=${security.forms.autocomplete}
                      <div> <label for="email">Email</label>
                      <input id="email" name="email" type="text" /></div>
                      <div> <label for="password">Password</label>
                      <input id="password" name="password" type="password" /></div>
                      <input type="submit" value="Submit" />
                      <input type="hidden" name="_csrf" value="${security.forms._csrf}" />
                      </form>`)
    }
  })
})
...

ERRORS

  • (‘forms/form-protection-disabled’) => thrown if the form protection policy object is not enabled. To change this, change formProtection.enabled = true in security.json
  • (‘forms/method-override-forbidden’) => thrown if method override is forbidden by policy (e.g. ‘allowMethodOverride : false’) and the method provided in the request object is neither ‘GET’ or ‘POST’