When set, unsafe methods must carry this custom header or the request
is rejected with 403. Simple form submits cannot set custom headers
without a preflight, making this a CSRF defense.
Type
string
Usage
import { type CsrfOptions } from "http-security-plugin/src/index.ts";