Registered by the plugin at priority 325 when the csrf option is present:
after the session loads at 260, after the cheap stateless Origin/Referer check
at 270, and after authentication at 300 — the bearer exemption reads the
credential source recorded and the session parked at 260, so a forged post is
rejected before the handler and a bearer request is exempt only when a
header-credential strategy authenticated it and it restored no session (the
session is new).
On failure it answers 403 and does not call next(), so neither
downstream middleware nor the handler runs.
// Registered automatically: SessionPlugin({ secret, csrf: {} }); // Or standalone, e.g. on a test app built with `autoStart: false`: app.middleware.add(csrfFormMiddleware({ headerName:'x-csrf-token' }), { priority:325 });
Builds the form-CSRF middleware.
Registered by the plugin at priority 325 when the
csrfoption is present: after the session loads at 260, after the cheap stateless Origin/Referer check at 270, and after authentication at 300 — the bearer exemption reads the credential source recorded and the session parked at 260, so a forged post is rejected before the handler and a bearer request is exempt only when a header-credential strategy authenticated it and it restored no session (the session is new).On failure it answers
403and does not callnext(), so neither downstream middleware nor the handler runs.