KemalIdentity::Kemal::CSRFHandler
Inherits Kemal::Handler < Kemal::HandlerInterface < HTTP::Handler < Reference < Object
Rejects an unsafe request without a valid CSRF token.
Registered after AuthenticationHandler, because the token binds to the session and this
needs to know whether there is one.
It reads the header before the body, deliberately
Touching env.params.body on a multipart request makes Kemal::ParamParser spool every
file part to a temporary file. On Kemal 1.10.0 – 1.12.0 those files were only cleaned up if
the request reached the route handler, so a middleware that parses and then rejects leaks
them permanently — an unauthenticated client could fill the disk one rejected upload at a
time. Kemal 1.13.0 moved cleanup into Kemal::InitHandler, which runs however the request
ends.
Checking X-CSRF-Token first means a client that sends the header never triggers body
parsing at all. A multipart form post still has to be parsed to find the field, so on a
Kemal below 1.13.0 that case still leaks — which is a reason to upgrade, and is why the
README says so.