Class: CsrfUtils
Defined in: auth/src/auth/CsrfUtils.ts:62
Issues and clears the double-submit CSRF cookie described in @rapidrest/service-core's
src/http/csrf/csrf.ts (see that module's doc comment for the full design, including why this
cookie is deliberately host-only even though the sibling jwt/refresh cookies TokenUtils issues
are commonly wildcard-domain for SSO). TokenUtils.createAuthResult() calls issueToken() right
alongside writing the jwt/refresh cookies, and TokenUtils.clearToken() calls clearToken()
alongside clearing them, so a fresh CSRF token is minted at every login/refresh/elevation and
removed at logout — the same lifecycle as the session it protects.
The token itself is generated by @rapidrest/service-core's generateCsrfToken()
(crypto.randomBytes(32).toString("base64url")), matching the random-token style OIDCStrategy
already uses for its own state CSRF token.
Constructors
Constructor
new CsrfUtils():
CsrfUtils
Returns
CsrfUtils
Properties
csrfConfig
protectedcsrfConfig:CsrfCookieConfig
Defined in: auth/src/auth/CsrfUtils.ts:64
Methods
clearToken()
clearToken(
res?):void
Defined in: auth/src/auth/CsrfUtils.ts:96
Clears the CSRF cookie previously written by issueToken(), when cookie issuance is enabled via
auth:csrf.enabled. Mirrors TokenUtils.clearToken()'s own clearing convention — called from
BaseAuthLogoutRoute alongside it.
Parameters
res?
HttpResponse
The response to write the clearing Set-Cookie header to.
Returns
void
issueToken()
issueToken(
res?):void
Defined in: auth/src/auth/CsrfUtils.ts:72
Generates a fresh CSRF token and writes it as a Set-Cookie header, when cookie issuance is
enabled via auth:csrf.enabled. No-op (and no cookie written) when res is omitted or disabled.
Parameters
res?
HttpResponse
The response to write the Set-Cookie header to.
Returns
void