Interface: CsrfCheckOptions

Defined in: service-core/src/http/csrf/csrf.ts:138

Options shared by ensureCsrfCookie()/verifyCsrfRequest()/createCsrfMiddleware().

Properties

allowedOrigins?

optional allowedOrigins?: string[]

Defined in: service-core/src/http/csrf/csrf.ts:154

Explicit allow-list of trusted browser origins (e.g. ["https://mail.example.com"]), used for the Origin/Referer check described in this module's doc comment. Typically the same list already configured for CORS (cors:origins) — callers default to that when this is left unset.

---

cookieName?

optional cookieName?: string

Defined in: service-core/src/http/csrf/csrf.ts:142

The CSRF cookie's name. Default "csrf".

---

enabled?

optional enabled?: boolean

Defined in: service-core/src/http/csrf/csrf.ts:140

Set to false to disable the check entirely (still leaves lazy cookie issuance in place). Default true.

---

headerName?

optional headerName?: string

Defined in: service-core/src/http/csrf/csrf.ts:144

The header a caller must echo the cookie's value on. Default "x-csrf-token".

---

logger?

optional logger?: object

Defined in: service-core/src/http/csrf/csrf.ts:156

Optional logger for a rejected request's reason — never logs the token values themselves.

warn?

optional warn?: (msg) => void

Parameters

msg

string

Returns

void

---

maxAge?

optional maxAge?: number

Defined in: service-core/src/http/csrf/csrf.ts:146

Max-Age (seconds) for a lazily-issued cookie. Omitted (session cookie) if not set.

---

secure?

optional secure?: boolean

Defined in: service-core/src/http/csrf/csrf.ts:148

Set to false to omit Secure from a lazily-issued cookie — plain-HTTP local dev only. Default true.