Struct CsrfMiddleware 

pub struct CsrfMiddleware { /* private fields */ }

Better Auth request protection middleware.

This mirrors the upstream TypeScript behavior:

• mutating requests with cookies require a trusted Origin / Referer
• first-login POST /sign-up/email and POST /sign-in/email also use Fetch Metadata headers to block cross-site navigation attacks
• callback / redirect targets are validated against trusted origins unless advanced.disable_origin_check is set

Implementations

impl CsrfMiddleware

pub const fn new(config: CsrfConfig, auth_config: Arc<AuthConfig>) -> Self

pub fn with_auth_config(&self, auth_config: Arc<AuthConfig>) -> Self

Retain protection settings with the effective request-local URL policy.

pub fn check_request_origin(&self, req: &AuthRequest) -> AuthResult<()>

Router protection after route/body resolution and before application hooks.

Errors

Rejects untrusted request origins and redirect targets.

pub fn check_form_origin(&self, req: &AuthRequest) -> AuthResult<()>

Endpoint-local first-login protection, after application before hooks.

Errors

Rejects cross-site navigation or untrusted first-login origins.

pub fn check_login_origin(&self, req: &AuthRequest) -> AuthResult<()>

Check an explicitly selected login operation using its genuine incoming request. The request URL need not be an auth route for a public server API call.

Errors

Rejects cross-site navigation or untrusted login origins.

Trait Implementations

impl Debug for CsrfMiddleware

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Middleware for CsrfMiddleware

fn name(&self) -> &'static str

Human-readable name for logging / debugging.

fn before_request<'life0, 'life1, 'async_trait>( &'life0 self, req: &'life1 AuthRequest, ) -> Pin<Box<dyn Future<Output = AuthResult<Option<AuthResponse>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Called before the request is dispatched to plugins.

fn after_request<'life0, 'life1, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, response: AuthResponse, ) -> Pin<Box<dyn Future<Output = AuthResult<AuthResponse>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Called after a response has been produced.