Read it through csrfTokenField; an application rendering its own
markup may read it directly, which is why the shape is named rather than
anonymous. The object is frozen, so a stray write throws under ESM's strict
mode instead of silently detaching from what the verifier checks.
What
csrfFormMiddlewarepublishes underCSRF_CONFIG_STATE_KEY: the resolved form field name, and nothing else the middleware also holds.Read it through
csrfTokenField; an application rendering its own markup may read it directly, which is why the shape is named rather than anonymous. The object is frozen, so a stray write throws under ESM's strict mode instead of silently detaching from what the verifier checks.Since
0.7.0