session/csrf
src/session/csrf.tur
synchronizer-token CSRF protection on top of the session.
Since: v0.2.0
defstruct
CsrfOpts
(defstruct CsrfOpts [])
CSRF middleware configuration.
defn
csrf-opts
(csrf-opts [field-name : cstr] :)
CsrfOpts with a custom form field name.
Since: v0.2.0
defn
default-csrf-opts
(default-csrf-opts :)
CsrfOpts with the default "csrf_token" form field.
Since: v0.2.0
defn
csrf-token
(csrf-token [ctx : Ctx] :)
the current session's CSRF token, minting one on first use.
Parameters
| ctx | tourist context |
Returns
:cstr -- the per-session token (64-char hex).
Since: v0.2.0
defn
csrf-check
(csrf-check [ctx : Ctx submitted : cstr] :)
constant-time compare a submitted token to the session's.
Parameters
| ctx | tourist context | |
| submitted | the token supplied by the request |
Since: v0.2.0
defn
csrf-mw
(csrf-mw [opts : CsrfOpts] :)
the CSRF before-middleware function; wire it with tourist's use!.
Parameters
| opts | CsrfOpts (default-csrf-opts / csrf-opts) |
Returns
(fn [Ctx] (Option Response)) -- pass to use!.
Since: v0.2.0
Internal definitions
__csrf-reg__csrf-set-field!__csrf-get-field__csrf-discard__null?__cstr-free__ctx-method-- request method string (borrowed).__ctx-body-- request body string (borrowed; NULL if absent).__ctx-header-- case-insensitive request header lookup (NULL if absent).__protected?-- true for state-changing methods (POST/PUT/PATCH/DELETE).__form-token-- value of `field` in an x-www-form-urlencoded body, or NULL.__csrf-pass?-- does this request carry a valid token (header or form)?__csrf-before-- the before-middleware decision for one request.