Language: TypeScript
Label: safe
CWE: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Code:
    { preValidation: fastifyPassport.authenticate('test', { authInfo: false }) },
    async () => 'success'
  )

  server.get('/csrf', async (_req, reply) => {
    return reply.generateCsrf()
  })
  server.get('/session', async (req) => {
    return req.session.get('_csrf')
  })
  return server
}