Structs§
- Csrf
Double Submit Cookie - Cookie flags for Double-Submit Cookie tokens.
- Csrf
Middleware - Actix Web middleware providing CSRF protection.
- Csrf
Middleware Config - Configuration for
CsrfMiddleware. - Csrf
Middleware Service - Csrf
Response - Csrf
Token - Extractor for the current CSRF token.
Enums§
- Csrf
Error - Reason a request was rejected by
CsrfMiddleware. - Csrf
Pattern - CSRF defense patterns for
CsrfMiddleware. - Csrf
Token Validator - Token
Class - Classification of CSRF tokens by context.
Constants§
- CSRF_
PRE_ SESSION_ KEY - Pre-session cookie minted for unauthenticated flows.
- DEFAULT_
CSRF_ ANON_ TOKEN_ KEY - Default cookie name for anonymous (pre-session) tokens, Double-Submit Cookie pattern.
- DEFAULT_
CSRF_ TOKEN_ FIELD - Default body field for the CSRF token when no header is present.
- DEFAULT_
CSRF_ TOKEN_ HEADER - Default header carrying the CSRF token.
- DEFAULT_
CSRF_ TOKEN_ KEY - Default name of the authorized CSRF token bucket.
- DEFAULT_
SESSION_ ID_ KEY - Default session id cookie; binds tokens and signals authorization state.
Traits§
- Csrf
Request Ext - Rotate or tear down CSRF state in a response,
as an extension on
HttpRequest.
Functions§
- eq_
tokens - Constant-time equality for token byte slices.
- generate_
hmac_ token_ ctx - Generates an HMAC-protected CSRF token bound to a context and identifier.
- generate_
random_ token - Generates a cryptographically secure random CSRF token.
- rotate_
csrf_ after_ login - Upgrade anonymous CSRF state to authorized
and write the cookie updates to
resp. - rotate_
csrf_ after_ logout - Tear down authorized CSRF state and write
the cookie updates to
resp. - validate_
hmac_ token - Validate an authorized-class CSRF token.
- validate_
hmac_ token_ ctx - Verifies an HMAC-protected CSRF token for a given class and identifier.