class

Grip::Middleware::CrossSiteRequestForgery

Inherits HTTP::Handler < Reference < Object

Constants

CHECK_METHODS = ["PUT", "POST", "PATCH", "DELETE"] of ::String
COOKIE_KEY = "csrf_token"
HEADER_KEY = "X-CSRF-Token"
PARAM_KEY = "_csrf"
TOKEN_LENGTH = 32

Constructors

new(secret : String, secure : Bool = true)
Source

Class methods

existing_token(context) : Bytes | Nil

Returns the raw token from a valid signed cookie, or nil

Source
mask(raw : Bytes) : String

XORs the raw token with a random one-time pad (pad + ciphertext), mitigating BREACH

Source
metatag(context : HTTP::Server::Context) : String

Meta tag so JavaScript can read the token and send it as a header

Source
raw_token(context) : Bytes

Returns the raw token, issuing a new cookie if the client has none

Source
secret
Source
secret=(secret : String)
Source
secure=(secure : Bool)
Source
secure?
Source
tag(context : HTTP::Server::Context) : String

Hidden input for HTML forms

Source
token(context : HTTP::Server::Context) : String

Masked token, different on every call; safe to embed in HTML

Source
unmask(masked : Bytes) : Bytes

Reverses mask by XORing the ciphertext with the pad that prefixes it

Source
valid?(raw : Bytes, sent : String) : Bool

Unmasks the submitted token and compares it to the raw token in constant time

Source

Instance methods

call(context : HTTP::Server::Context)

Rejects unsafe requests whose submitted token doesn't match the cookie token

Source