Summary by cubic

Fixes XSRF token leakage by requiring withXSRFToken === true for cross-origin requests; otherwise the token only sends for same-origin. Adds browser tests to block truthy non-boolean values and prototype pollution (AXI-205).

Description

• Summary of changes
  • In lib/helpers/resolveConfig.js, compute a strict shouldSendXSRF boolean.
  • Send XSRF header only when withXSRFToken === true, or when withXSRFToken is null/undefined and the URL is same-origin.
• Reasoning
  • Prevent cross-origin leakage via truthy non-boolean values and Object.prototype pollution (GHSA-xx6v-rp6x-q39c).
• Additional context
  • Aligns with AXI-205.
  • Synced with latest v1.x (no functional changes).

Docs

Please update /docs/ to clarify withXSRFToken:

• Only true forces sending the token cross-origin.
• Non-boolean values are ignored.
• Default (undefined) sends only on same-origin.

Testing

• Added browser tests in tests/browser/xsrf.browser.test.js to:
  • Block cross-origin sends for truthy non-booleans and polluted Object.prototype.
  • Keep behavior for withXSRFToken === true cross-origin and default same-origin.
• No other test changes needed.

Semantic version impact

Patch: security bug fix with no API changes.

^{Written for commit bf3a288. Summary will update on new commits.}