Repository: freeCodeCamp/freeCodeCamp
File: api/src/app.ts (TypeScript)

Code before:
    ///Ignore all other possible sources of CSRF
    // tokens since we know we can provide this one
    getToken: req => req.headers['csrf-token'] as string
  });

  // All routes should add a CSRF token to the response
  fastify.addHook('onRequest', (_req, reply, done) => {
    const token = reply.generateCsrf();
    // Path is necessary to ensure that only one cookie is set and it is valid
    // for all routes.
    void reply.setCookie('csrf_token', token, {
      path: '/',
      sameSite: 'strict',
      domain: COOKIE_DOMAIN,
      secure: FREECODECAMP_NODE_ENV === 'production'
    });
    done();
  });

  // @ts-expect-error - @fastify/session's types are not, yet, compatible with
  // express-session's types
  await fastify.register(fastifySession, {
    secret: SESSION_SECRET,
    rolling: false,
    saveUninitialized: false,
    // cookieName: 'jwt_access_token', NOTE: Confirm if we want to use different cookie name for session token
    cookie: {
      maxAge: 1000 * 60 * 60, // 1 hour
      secure: FREECODECAMP_NODE_ENV !== 'development'
    },
    store: MongoStore.create({
      mongoUrl: MONGOHQ_URL
    })
  });

  const provider =
    EMAIL_PROVIDER === 'ses' ? new SESProvider() : new NodemailerProvider();
  void fastify.register(mailer, { provider });

  // Swagger plugin
  if (FCC_ENABLE_SWAGGER_UI) {
    void fastify.register(fastifySwagger, {
      openapi: {
        info: {
          title: 'freeCodeCamp API',
          version: '1.0.0' // API version
        },
        components: {
          securitySchemes: {
            session: {
              type: 'apiKey',

Review comment (suggestion):
```suggestion
```
If I understand correctly, this is no longer necessary.

Code after:
  });

  // All routes should add a CSRF token to the response
  fastify.addHook('onRequest', (_req, reply, done) => {
    const token = reply.generateCsrf();
    // Path is necessary to ensure that only one cookie is set and it is valid
    // for all routes.
    void reply.setCookie('csrf_token', token, {
      path: '/',
      sameSite: 'strict',
      domain: COOKIE_DOMAIN,
      secure: FREECODECAMP_NODE_ENV === 'production'
    });
    done();
  });

  // @ts-expect-error - @fastify/session's types are not, yet, compatible with
  // express-session's types
  await fastify.register(fastifySession, {
    secret: SESSION_SECRET,
    rolling: false,
    saveUninitialized: false,
    cookie: {
      maxAge: 1000 * 60 * 60, // 1 hour
      secure: FREECODECAMP_NODE_ENV !== 'development'
    },
    store: MongoStore.create({
      mongoUrl: MONGOHQ_URL
    })
  });

  const provider =
    EMAIL_PROVIDER === 'ses' ? new SESProvider() : new NodemailerProvider();
  void fastify.register(mailer, { provider });

  // Swagger plugin
  if (FCC_ENABLE_SWAGGER_UI) {
    void fastify.register(fastifySwagger, {
      openapi: {
        info: {
          title: 'freeCodeCamp API',
          version: '1.0.0' // API version
        },
        components: {
          securitySchemes: {
            session: {
              type: 'apiKey',
              name: 'sessionId',
              in: 'cookie'
            }
          }