interface CsrfFormOptions
Since 0.2.0

Form-CSRF options.

Properties

readonly
optional
fieldName: string

Form field carrying the token. Default '_csrf'.

readonly
optional
headerName: string

Header that may carry the token instead of a form field, for fetch-based posts and for multipart/form-data bodies this package does not parse. Default 'x-csrf-token'; header reading cannot be disabled — a synchroniser token that cannot be presented is not a security control.

readonly
optional
ignoreMethods: readonly string[]

Methods that skip verification. Default ['GET', 'HEAD', 'OPTIONS'].

readonly
optional
exclude: readonly (string | RegExp)[]

Request paths exempt from form-CSRF verification, matched by exact string equality or RegExp.test. Omitted means no path is exempt.

Use this only for a protocol endpoint that cannot carry a browser session token (for example, a separately-mounted Connect/gRPC surface). Do not use it to bypass CSRF for application form routes.

Usage

import { type CsrfFormOptions } from "session-plugin/src/index.ts";