CsrfOptionsType

CsrfOptionsType = object

Defined in: src/http/middleware/CsrfOptions.ts:20

Plain settings shape for csrfProtection.

Properties

allowedOrigins?

readonly optional allowedOrigins?: ReadonlyArray<string>

Defined in: src/http/middleware/CsrfOptions.ts:32

Extra full origins accepted by the origin check.

---

cookie?

readonly optional cookie?: CsrfCookieOptions

Defined in: src/http/middleware/CsrfOptions.ts:28

Cookie attributes. Defaults: Path=/, Secure, SameSite=Lax, HttpOnly=false.

---

cookieName?

readonly optional cookieName?: string

Defined in: src/http/middleware/CsrfOptions.ts:24

Cookie name. Default 'csrf-token'.

---

formFieldName?

readonly optional formFieldName?: string

Defined in: src/http/middleware/CsrfOptions.ts:34

Also read the token from this urlencoded body field (classic forms). Default off.

---

headerName?

readonly optional headerName?: string

Defined in: src/http/middleware/CsrfOptions.ts:26

Request header carrying the token. Default 'x-csrf-token'.

---

secret?

readonly optional secret?: string | Uint8Array

Defined in: src/http/middleware/CsrfOptions.ts:22

REQUIRED — HMAC key, at least 16 bytes (32 recommended).

---

verifyOrigin?

readonly optional verifyOrigin?: boolean

Defined in: src/http/middleware/CsrfOptions.ts:30

Also require a same-origin Origin/Referer on unsafe methods. Default true.