fastify-nextjs VS csrf-protection

I like fastify more than express due to the great opinions (json schema, hooks etc). I use fastify + the fastify-nextjs plugin. It works great and lets you expose custom request decorations from node.js to next.js.

Maybe this can help you too: https://github.com/fastify/fastify-nextjs

The only drawback is the slow startup time of next.js, which becomes really annoying with huge next.js projects. But for smaller projects, fastify-nextjs is fine.

First of all, fastify/csrf-protection * Their default getTokenValue is okay as it is retrieving the token value from custom headers, which can only be sent by JS on the same domain. It does not have the same body/query param fall back like csurf. * They introduced a "userInfo" property in order to avoid session-hijacking, however, in doing this, they introduced a BIG problem. * If you use their userInfo option, you can no longer use their protection to protect unauthenticated routes. * Session hijacking should be resolved by destroying and re-creating sessions after login and after logout, it should NOT be dependent on the CSRF protection layer. * They are using their own fork of csrf which was originally used by csurf and is a tad outdated, this protection does not let you configure the size of your tokens.