Function: verifyCsrfRequest()

verifyCsrfRequest(req, options?): void

Defined in: service-core/src/http/csrf/csrf.ts:190

Verifies req against the double-submit CSRF cookie plus Origin/Referer allow-list, per the scheme documented at the top of this module. Throws an ApiError (AUTH_CSRF_FAILURE, 403) on failure. A safe method (GET/HEAD/OPTIONS) or options.enabled === false always passes without throwing.

This does not check req.auth?.source — that gate belongs to the caller (see RouteUtils.checkCsrf(), which only calls this when req.auth?.source === "cookie"). A caller like BaseOAuthAuthorizeRoute's decideConsent(), which authenticates via req.session instead of a JWT, calls this unconditionally for exactly that reason.

Parameters

req

HttpRequest

options?

CsrfCheckOptions = {}

Returns

void