Advisories for Npm/Fastify-Csrf package

fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks.

The generated cookie uses insecure defaults, and does not have the httpOnly flag on cookieOpts: { path: '/', sameSite: true }. Additionally, the CSRF token is available in the GET query parameter.