fastify-rate-limit VS csrf-protection

fastify-rate-limit is a plugin for the Fastify web framework that provides an easy-to-use interface for implementing rate limiting in your Node.js applications. The plugin lets you specify the maximum number of requests a client can make within a specific timeframe and the response to send when this limit is exceeded.

We can do it by our own, but i'll use for now Fastify-rate-limit plugin to achieve this easily.

First of all, fastify/csrf-protection * Their default getTokenValue is okay as it is retrieving the token value from custom headers, which can only be sent by JS on the same domain. It does not have the same body/query param fall back like csurf. * They introduced a "userInfo" property in order to avoid session-hijacking, however, in doing this, they introduced a BIG problem. * If you use their userInfo option, you can no longer use their protection to protect unauthenticated routes. * Session hijacking should be resolved by destroying and re-creating sessions after login and after logout, it should NOT be dependent on the CSRF protection layer. * They are using their own fork of csrf which was originally used by csurf and is a tad outdated, this protection does not let you configure the size of your tokens.