Form state is shared between different requests about forms HOT 7 CLOSED

This is kind of a huge problem, what with security and privacy. Does anyone know how it can be fixed?

from forms.

I haven't used it in a while but I think this fork fixes the problem: https://github.com/tdryer/forms

On 2 Apr 2012, at 06:59, Jordan Harband wrote:

This is kind of a huge problem, what with security and privacy. Does anyone know how it can be fixed?

---

Reply to this email directly or view it on GitHub:
#13 (comment)

from forms.

This is a scary problem... however, looking at your code I think can see why it's happening. You're using the same object between different routes. Your signupForm will only ever be constructed once. Although I haven't tested this, I believe re-factoring your code like so should fix your problem:

//controller.js, imported into app.js

var forms = require('../lib/forms'),
    fields = forms.fields,
    validators = forms.validators;

var signupForm = function() {
    return forms.create({

        first_name: fields.string({ required: true }),
        last_name: fields.string({ required: true }),
        email: fields.email({ required: true }),
        password: fields.password({ required: true }),
        password_confirm: fields.password({
            required: true,
            validators: validators.matchField('password')
        })

    });
};

module.exports = function(app) {

    app.get('/signup', function(req, res, next) {
        res.render('signup', {
            signupForm: signupForm().toHTML()
        });
    });

    app.post('/signup', function(req, res, next) {
        signupForm().handle(req.body, {
            success: function(form) {
                res.redirect('/app');
            },
            other: function(form) {
                res.render('signup', {
                    form: form.toHTML()
                });
            }
        });
    });
};

from forms.

The form should only need to be created once. However, its value should not persist beyond a single request, and refactoring our code to remove the benefit of caching seems inappropriate. It seems that tdryer@86f354d fixes the problem, so it just needs to be merged into the main project.

from forms.

Ahha... agreed. Much better way of go about it.

from forms.

Please see the comments on #16 for an update on this issue

from forms.

Fixed by #16

from forms.