CSRF tokens cause breakage on build using serverless environments due to incompatible exports of Node Crypto

[69u]

Version

nuxt-security: v0.13.1
nuxt: v3.6.0
nuxt-csrf: v1.2.0

Reproduction Link

https://github.com/69u/NS-Serverless-Reproduction

Steps to reproduce

1. Build the project using yarn build

What is Expected?

1. App should return a heading that contains a generated CSRF token

What is actually happening?

1. The app displays the CSRF token perfectly when in development
2. Upon building the app, Nuxt-CSRF cannot find some exports of crypto as they do not exist in serverless environments

Possible Solution?

@zsilbi has created a fork of Nuxt-CSRF supporting serverless environments, potentially create a configuration for these serverless environments and use this forked version of the module instead: https://github.com/zsilbi/nuxt-csurf

[Baroshem]

Hey, thanks for reporting this issue.

Related to #150

I think, we can replace the existing module with the one you linked. I would just need to test it properly if it works the same way as the original one.

[69u]

Hey there, I have fixed up the previously mentioned module a little, its available here - I am happy to have a crack at integrating it into this module when I get the chance to :)

[zsilbi]

I think, we can replace the existing module with the one you linked. I would just need to test it properly if it works the same way as the original one.

The only problem is that Nuxt 3 currently supports Node.js - v16.10.0 or newer.
This fork uses the Web Crypto API which is supported only since v19.

[69u]

I think, we can replace the existing module with the one you linked. I would just need to test it properly if it works the same way as the original one.

The only problem is that Nuxt 3 currently supports Node.js - v16.10.0 or newer. This fork uses the Web Crypto API which is supported only since v19.

There is partial support for Web Crypto API for Node.JS v15.0.0 - v18.0.0 as mentioned here but it was released fully with Node.JS v19.0.0, I am not sure if this PR works with Node versions < v19.0.0

[Baroshem]

Hey folks,

For anyone here experiencing the same issue. There is a PR where nuxt-csurf is migrated to support serverless environments but there a beta is used.

I will wait until the proper stable version of nuxt-csurf will be released and then merge this PR to not cause issues for users.

If you want to make this work, you can always use certain version of the underlying module (the beta version).

I messaged the package author to ask when the stable version will be released.