Options for CSRF middleware.
readonly
optional
enabled: boolean
Enable/disable CSRF protection. Defaults to true when present.
readonly
optional
trustedOrigins: readonly string[]
Additional trusted origins (scheme+host) beyond the request's own origin.
The request's own origin (derived from request.url) is always implicitly
trusted. Default: [].
readonly
optional
customHeader: string
When set, unsafe methods must carry this custom header or the request is rejected with 403. Simple form submits cannot set custom headers without a preflight, making this a CSRF defense.