class

Azu::Handler::CSRF

Inherits HTTP::Handler < Reference < Object

The CSRF Handler implements Cross-Site Request Forgery protection following OWASP recommendations for token-based mitigation

Constants

COOKIE_KEY = "csrf_token"
COOKIE_MAX_AGE = 86400

Cookie configuration

COOKIE_SAME_SITE = HTTP::Cookie::SameSite::Strict
HEADER_KEY = "X-CSRF-TOKEN"

Headers and parameters for CSRF tokens

HMAC_SECRET_LENGTH = 64
PARAM_KEY = "_csrf"
TOKEN_LENGTH = 32

Token configuration

UNSAFE_METHODS = ["POST", "PUT", "PATCH", "DELETE"] of ::String

HTTP methods that require CSRF protection

Constructors

default

Get default instance (backward compatibility) Uses double-checked locking to avoid mutex contention

Source
new(skip_routes : Array(String) = [] of String, strategy : Strategy = Strategy::SignedDoubleSubmit, secret_key : String | Nil = nil, cookie_name : String = COOKIE_KEY, header_name : String = HEADER_KEY, param_name : String = PARAM_KEY, cookie_max_age : Int32 = COOKIE_MAX_AGE, cookie_same_site : HTTP::Cookie::SameSite = COOKIE_SAME_SITE, secure_cookies : Bool = true)
Source

Class methods

configure

Configuration block

Source
cookie_max_age=(value : Int32)
Source
cookie_name=(value : String)
Source
header_name
Source
header_name=(value : String)
Source
metatag(context : HTTP::Server::Context) : String
Source
param_name
Source
param_name=(value : String)
Source
reset_default!

Reset default instance (useful for testing)

Source
secret_key
Source
secret_key=(value : String)
Source
secure_cookies
Source
secure_cookies=(value : Bool)
Source
strategy

Class-level property accessors that delegate to default instance

Source
strategy=(value : Strategy)
Source
tag(context : HTTP::Server::Context) : String
Source
token(context : HTTP::Server::Context) : String

Class-level methods for backward compatibility These delegate to the default instance

Source
use_double_submit!
Source
use_signed_double_submit!

Configuration helper methods

Source
use_synchronizer_token!
Source
validate_origin(context : HTTP::Server::Context) : Bool
Source

Instance methods

call(context : HTTP::Server::Context)
Source
cookie_max_age=(cookie_max_age : Int32)
Source
cookie_name=(cookie_name : String)
Source
cookie_same_site
Source
cookie_same_site=(cookie_same_site : HTTP::Cookie::SameSite)
Source
header_name
Source
header_name=(header_name : String)
Source
metatag(context : HTTP::Server::Context) : String

Generate meta tag with CSRF token for AJAX requests

Source
param_name
Source
param_name=(param_name : String)
Source
secret_key
Source
secret_key=(secret_key : String)
Source
secure_cookies=(secure_cookies : Bool)
Source
secure_cookies?
Source
strategy

Instance-level configuration properties

Source
strategy=(strategy : Strategy)

Instance-level configuration properties

Source
tag(context : HTTP::Server::Context) : String

Generate HTML hidden input with CSRF token

Source
token(context : HTTP::Server::Context) : String

Generate CSRF token for forms/AJAX requests

Source
valid_token?(context : HTTP::Server::Context) : Bool

Validate CSRF token based on configured strategy

Source
validate_origin(context : HTTP::Server::Context) : Bool

Origin validation (additional security layer)

Source

Nested types