Interface: CsrfCookieConfig
Defined in: auth/src/auth/CsrfUtils.ts:19
Configuration options controlling the CSRF cookie CsrfUtils writes alongside the jwt/refresh
cookies TokenUtils issues.
Properties
enabled?
optionalenabled?:boolean
Defined in: auth/src/auth/CsrfUtils.ts:34
Set to true to rotate the CSRF cookie at every point TokenUtils issues or clears the jwt/
refresh cookies (login, refresh, elevation, logout). Default false, matching TokenUtils'
own auth:cookie.enabled default: a CSRF cookie only matters once jwt/refresh are
themselves issued as cookies in the first place.
Rotation here is defense-in-depth, not the only way a caller ever gets this cookie —
@rapidrest/service-core's RouteUtils.checkCsrf() also lazily issues one on any request that
doesn't already have it (see that module's doc comment), which is what lets a caller who signed
in before this was enabled, or a service that never goes through TokenUtils at all (e.g.
server/restapi), still end up with a valid cookie. What rotation buys on top of that: a
fresh, unguessable token at every privilege change (login, elevation) instead of carrying the
same value across a session indefinitely.
maxAge?
optionalmaxAge?:number
Defined in: auth/src/auth/CsrfUtils.ts:40
The Max-Age attribute, in seconds. Omitted (session cookie) if not set.
name?
optionalname?:string
Defined in: auth/src/auth/CsrfUtils.ts:36
The cookie's name. Default "csrf" (DEFAULT_CSRF_COOKIE_NAME).
path?
optionalpath?:string
Defined in: auth/src/auth/CsrfUtils.ts:38
The Path attribute. Default /.
sameSite?
optionalsameSite?:"Strict"|"Lax"|"None"
Defined in: auth/src/auth/CsrfUtils.ts:42
The SameSite attribute. Default Lax.
secure?
optionalsecure?:boolean
Defined in: auth/src/auth/CsrfUtils.ts:44
Set to false to omit the Secure (HTTPS-only) attribute — only for plain-HTTP local dev. Default true.