csurf deprecation

[ob6160]

👋 It looks like the csurf package used for CSRF protection:

gateway/src/server/lib/middleware/csrf.ts

Line 1 in 15fba29

import csrf from 'csurf';

is deprecated which could be a potential risk (albeit, a small one).

Perhaps a package could be avoided completely here?

(came across this as I was using GW as a reference for csrf implementation elsewhere 😄 )

[coldlink]

Thanks! Yeah we're already aware of this. The risk is fairly low thankfully, but we're planning on making our own implementation when we get time, specifically the Signed Double-Submit Cookie method (which is the method we're already using with the current library).