Cross-site Request Forgery (CSRF)

@fastify/passport is vulnerable to Cross-site Request Forgery (CSRF). When a user logs in, the library doesn’t remove the session object, keeping the _csrf property in tact across unauthenticated and authorized sessions. CSRF tokens created prior to authentication are therefore still valid. Thus, network and same-site attackers can acquire a CSRF token for their pre-session, fixate that pre-session in the victim’s browser via cookie throwing, and then carry out a CSRF attack once the victim authenticates. Note that the vulnerability is only applicable if @fastify/csrf-protection is used for CSRF protection.