struct

KemalIdentity::CSRFConfig

Inherits Struct < Value < Object

How CSRF protection is named and scoped. Boot-time and immutable.

Constants

MIN_SECRET_BYTES = 32

Minimum signing key length. A short key is a weak signature, and this is the one place a weak default would be invisible.

SAFE_METHODS = ["GET", "HEAD", "OPTIONS", "TRACE", "QUERY"] of ::String

Anything not on this list is protected. A denylist of POST/PUT/PATCH/DELETE would leave every method nobody thought of unprotected — PROPFIND mutates in WebDAV, and HTTP QUERY did not exist when this shard was designed. Safe-by-name, protected otherwise.

QUERY is here because RFC 10008 defines it as safe and idempotent. It carries a request body, which makes it easy to mistake for a mutation; it is not one, and a spec asserts that its body does not get it treated as one.

Constructors

new(secret : String, cookie_name : String = "__Host-kemal_identity_csrf", header_name : String = "X-CSRF-Token", field_name : String = "_csrf", secure : Bool = true, exempt_prefixes : Array(String) = [] of String)
Source

Instance methods

build_cookie(value : String) : HTTP::Cookie

The anchor cookie.

HttpOnly, because nothing client-side needs to read it: the token itself is rendered into the page, and the anchor is only ever compared server-side. __Host- by default, which forbids a Domain attribute — so a compromised sibling subdomain cannot plant an anchor value the attacker knows, which is what makes the anonymous login-form case hold.

Source
exempt?(path : String) : Bool
Source
exempt_prefixes
Source
field_name
Source
header_name
Source
inspect(io : IO) : Nil

Never prints the secret.

Source
protects?(method : String) : Bool
Source
secret
Source
secure?
Source
to_s(io : IO) : Nil

Same as #inspect(io).

Source