Are you happy with your logging solution? Would you help us out by taking a 30-second survey? Click here


CSRF crumb generation and validation for hapi

Subscribe to updates I use crumb

Statistics on crumb

Number of watchers on Github 145
Number of open issues 6
Average time to close an issue about 2 months
Main language JavaScript
Average time to merge a PR 4 days
Open pull requests 7+
Closed pull requests 7+
Last commit almost 2 years ago
Repo Created over 6 years ago
Repo Last Updated over 1 year ago
Size 455 KB
Organization / Authorhapijs
Latest Releasev6.0.3
Page Updated
Do you use crumb? Leave a review!
View open issues (6)
View crumb activity
View on github
Fresh, new opensource launches 🚀🚀🚀
Trendy new open source projects in your inbox! View examples

Subscribe to our mailing list

Evaluating crumb for your project? Score Explanation
Commits Score (?)
Issues & PR Score (?)

crumb Logo

CSRF crumb generation and validation for hapi

Build Status

Lead Maintainer: Jonathan Samines

About CSRF

What to Use Crumb for and When to Use It

Crumb is used to diminish CSRF attacks using a random unique token that is validated on the server side.

Crumb may be used whenever you want to prevent malicious code to execute system commands, that are performed by HTTP requests. For example, if users are able to publish code on your website, malicious code added by a user could force every other user who opens the page, to load and execute code from a third party website e.g. via an HTML image tag. With Crumb implemented into your hapi.js application, you are able to verify requests with unique tokens and prevent the execution of malicious requests.


Crumb has been refactored to securely work with CORS, as OWASP recommends using CSRF protection with CORS.

It is highly discouraged to have a production servers cors.origin setting set to [\*] or true with Crumb as it will leak the crumb token to potentially malicious sites


  const Hapi = require('hapi');
  const Crumb = require('crumb');

  const server = new Hapi.Server({
    port: 8000

  (async () => {
    await server.register({
      plugin: Crumb,

      // plugin options
      options: {}

      path: '/login',
      method: 'GET',
      options: {
        plugins: {
          // route specific options
          crumb: {}
        handler(request, h) {
          // this requires to have a view engine configured
          return h.view('some-view');

For a complete example see the examples folder.


The following options are available when registering the plugin.

Registration options

  • key - the name of the cookie to store the csrf crumb into. Defaults to crumb.
  • size - the length of the crumb to generate. Defaults to 43, which is 256 bits, see cryptile for more information.
  • autoGenerate - whether to automatically generate a new crumb for requests. Defaults to true.
  • addToViewContext - whether to automatically add the crumb to view contexts as the given key. Defaults to true.
  • cookieOptions - storage options for the cookie containing the crumb, see the server.state documentation of hapi for more information. Default to cookieOptions.path=/
  • restful - RESTful mode that validates crumb tokens from X-CSRF-Token request header for POST, PUT, PATCH and DELETE server routes. Disables payload/query crumb validation. Defaults to false.
  • skip - a function with the signature of function (request, h) {}, which when provided, is called for every request. If the provided function returns true, validation and generation of crumb is skipped. Defaults to false.

Routes configuration

Additionally, some configuration can be passed on a per-route basis. Disable Crumb for a particular route by passing false instead of a configuration object.

  • key - the key used in the view contexts and payloads for the crumb. Defaults to plugin.key.
  • source - can be either payload or query specifying how the crumb will be sent in requests. Defaults to payload.
  • restful - an override for the server's 'restful' setting. Defaults to plugin.restful.
crumb open issues Ask a question     (View All Issues)
  • almost 3 years Restful validation with autoGenerate set to false not working
  • about 4 years Provide more relevant feedback
crumb open pull requests (View All Pulls)
  • Update restful example to respond with JSON. Closes #64
  • fix route restful bug
  • Documentation Improvement
  • Update
  • Add sentence to README about how to disable the plugin for a particular route.
  • Make both examples runnable with a package.json and proper dependencies
  • Add an option to specify the CSRF header name
crumb questions on Stackoverflow (View All Questions)
  • Bread crumb in mvcSiteMapNode
  • Bread crumb trails in user documentation generated by doxygen
  • Trigger parameterized build with curl and crumb
  • Blog post url should be same as websites bread crumb navigation
  • Unable to get crumb for Yahoo Messenger API
  • Add glyphicons to a Bread Crumb
  • how bread crumb use in angularjs?
  • Implementing a bread crumb in Django
  • How to draw route on map with using crumb path?
  • Hapijs crumb plugin give me undefined crumb
  • Crumb with Golang's net/http header
  • Knockout.js & Bootstrap 3 - Bread Crumb Pseudo Element
  • How to request for Crumb issuer for jenkins
  • drupal bread crumb view to show only Home > Search
  • Simple Bread Crumb with regex
  • How to strip out part of a bread crumb path in postgresql
  • How do I implement bread-crumb navigation similar to Facebook?
  • Is that possible to add a tool tip in a bread crumb?
  • Bread Crumb Pattern in mvc 2.0
  • CodeIgniter encrypted key at the url with Auto Crumb helper
  • Bread Crumb Pattern Implementation
  • Bread crumb not working properly
  • How to create bread crumb using Menu items in
  • Path Enumeration mySQL Querying to create a bread crumb
  • Bread-crumb style navigation for Winforms
  • Vertical Align a Bread Crumb using ASP.Net <asp:SiteMapPath> control
  • page wide bread crumb bar as at
  • How do I implement an address location bar (bread crumb control) similar to that in Windows Vista's File Explorer?
  • localized sitemap, bread crumb and menu
  • Windows Explorer Crumb-Bar Control
crumb list of languages used
Other projects in JavaScript