Setu-TS
    Preparing search index...

    Function csrfTokenField

    • Renders this session's CSRF token as a hidden HTML form field.

      The returned markup uses the same mint-once token path as getCsrfToken. Its field name follows the plugin's configured csrf.fieldName: csrfFormMiddleware publishes its resolved configuration under CSRF_CONFIG_STATE_KEY, and this helper reads it, so a form rendered by this helper names the field the verifier reads. An explicit options.fieldName wins as an override (for a standalone csrfFormMiddleware on a different name, or a custom renderer); with no published config and no argument — a request the middleware never saw, such as a React Router action — the shared '_csrf' default applies. In an escaping Hono template, wrap the returned trusted markup with that template runtime's raw() helper.

      Parameters

      • ctx: IRequestContext

        The request context

      • options: Pick<CsrfFormOptions, "fieldName"> = {}

        An explicit field-name override; omitted reads the published form-CSRF configuration, then the shared default

      Returns string

      A hidden input containing the session's CSRF token

      If SessionPlugin or RuntimePlugin is not registered

      If the session middleware did not run

      app.router.get('/login', (ctx) => {
        return ctx.response.html(
          `<form method="post">${csrfTokenField(ctx)}<button>Sign in</button></form>`,
        );
      });

      0.6.0

    Settings
    Member Visibility