Language: TypeScript
Label: safe
CWE: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Code:
  async logIn(request: FastifyRequest, user: any) {
    const object = await this.serializeUser(user, request)

    if (this.clearSessionOnLogin && object) {
      // Handle @fastify/session to prevent token/CSRF fixation
      if (request.session.regenerate) {
        await request.session.regenerate(this.clearSessionIgnoreFields)
      } else {
        const currentFields = request.session.data() || {}
        // Handle @fastify/secure-session against CSRF fixation
        // TODO: This is quite hacky. The best option would be having a regenerate method
        // on secure-session as well
        for (const field of Object.keys(currentFields)) {
          if (this.clearSessionIgnoreFields.includes(field)) {
            continue
          }
          request.session.set(field, undefined)
        }
      }
    }

    // Handle sessions using @fastify/session
    if (request.session.regenerate) {
      // regenerate session to guard against session fixation
      await request.session.regenerate()
    }
    request.session.set(this.key, object)
  }