interface CsrfOptions

Options for CSRF middleware.

Properties

readonly
optional
enabled: boolean

Enable/disable CSRF protection. Defaults to true when present.

readonly
optional
trustedOrigins: readonly string[]

Additional trusted origins (scheme+host) beyond the request's own origin. The request's own origin (derived from request.url) is always implicitly trusted. Default: [].

readonly
optional
customHeader: string

When set, unsafe methods must carry this custom header or the request is rejected with 403. Simple form submits cannot set custom headers without a preflight, making this a CSRF defense.

Usage

import { type CsrfOptions } from "http-security-plugin/src/index.ts";