Repository navigation
fix: explicit cbcsrf module settings win over the cbsecurity csrf key - #75
Merged
Merged
Conversation
cbsecurity copied its csrf settings, defaults included, over the cbcsrf module settings, so settings set on cbcsrf itself were silently lost. The precedence is now explicit cbcsrf settings, then explicit cbsecurity.csrf, then the defaults. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E8yy4oK5vnaVucmYLg4UtY
Only keys the user set in cbsecurity.csrf are applied on top of the cbcsrf module settings. Everything else keeps the cbcsrf value, so cbsecurity defaults never overwrite a cbcsrf override. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E8yy4oK5vnaVucmYLg4UtY
lmajano
pushed a commit
to ortus-docs/cbsecurity-docs
that referenced
this pull request
Oct 9, 2026
Matches coldbox-modules/cbsecurity#75. Only keys set in cbsecurity.csrf are applied, other keys keep the cbcsrf value. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E8yy4oK5vnaVucmYLg4UtY
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
cbcsrfis a module with its own settings, and cbsecurity also has acsrfkey that configures it. At startup cbsecurity copied its wholecsrfblock, defaults included, over thecbcsrfmodule settings. So anything set oncbcsrfitself was silently lost, even whencbsecurity.csrfwas never set. A client hit this: they configuredcbcsrfand cbsecurity overrode it again.The precedence is now, per setting, highest first:
cbcsrfmodule settings (moduleSettings.cbcsrf, orconfig/modules/cbcsrf.cfc).cbsecurity.csrf.cbsecurity.csrfnow shows the values that are in effect.How it works:
onDIComplete()records what the user set incbsecurity.csrfbefore the defaults are merged, andresolveCsrfSettings()merges it with thecbcsrfsettings. Acbcsrfkey counts as user set when it is in the app'smoduleSettings.cbcsrf, or when its value differs from the default (which coversconfig/modules/cbcsrf.cfc, since ColdBox merges that into the module settings). The one gap: acbcsrfvalue explicitly set to the default, whilecbsecurity.csrfsets something different, lets cbsecurity win.Behavior change
Anyone who set the same key on both modules and relied on
cbsecurity.csrfwinning now gets thecbcsrfvalue.Issues
No issue is linked yet, please link or create one.
Type of change
Checklist
Testing
BoxLang 1.18, TestBox 7.1. 8 new unit specs (
CsrfSettingsSpec), all 37 unit specs pass. The integration run shows the same 1 failure and 15 errors as before this change, all JWT database specs with no datasource in my sandbox.I also ran the real app with five configurations and read the effective
cbcsrfsettings:rotationTimeoutin effectcbcsrf= 99cbsecurity.csrf= 77cbcsrftimeout 99,cbsecurity.csrfenableEndpoint trueI could not run Adobe, Lucee or ColdBox 7 locally.
🤖 Generated with Claude Code
https://claude.ai/code/session_01E8yy4oK5vnaVucmYLg4UtY
Generated by Claude Code