function csrfFormMiddleware
Since 0.2.0
csrfFormMiddleware(options?: CsrfFormOptions): MiddlewareFunction

Builds the form-CSRF middleware.

Registered by the plugin at priority 275 when the csrf option is present: after the session loads at 260, after the cheap stateless Origin/Referer check at 270, and before authentication at 300 so a forged post is rejected before any credential work happens.

On failure it answers 403 and does not call next(), so neither downstream middleware nor the handler runs.

Examples

Example 1

// Registered automatically:
SessionPlugin({ secret, csrf: {} });
// Or standalone, e.g. on a test app built with `autoStart: false`:
app.middleware.add(csrfFormMiddleware({ headerName: 'x-csrf-token' }), { priority: 275 });

Parameters

optional
options: CsrfFormOptions

CSRF options; the plugin passes its own csrf block through

Return Type

MiddlewareFunction

The middleware function

Usage

import { csrfFormMiddleware } from "session-plugin/src/index.ts";