function csrfTokenField
Since 0.5.0
csrfTokenField(
ctx: IRequestContext,
options?: Pick<CsrfFormOptions, "fieldName">
): string

Renders this session's CSRF token as a hidden HTML form field.

The returned markup uses the same mint-once token path as getCsrfToken. Its field name must match the fieldName supplied to SessionPlugin({ csrf: ... }); omitting it uses the shared '_csrf' default. In an escaping Hono template, wrap the returned trusted markup with that template runtime's raw() helper.

Examples

Example 1

app.router.get('/login', (ctx) => {
  return ctx.response.html(
    `<form method="post">${csrfTokenField(ctx)}<button>Sign in</button></form>`,
  );
});

Parameters

ctx: IRequestContext

The request context

optional
options: Pick<CsrfFormOptions, "fieldName">

The field-name option shared with form-CSRF configuration

Return Type

string

A hidden input containing the session's CSRF token

Throws

Error

If SessionPlugin or RuntimePlugin is not registered

SessionMiddlewareMissingError

If the session middleware did not run

Usage

import { csrfTokenField } from "session-plugin/src/index.ts";