Struct CsrfConfig 

pub struct CsrfConfig {
    pub enabled: bool,
    pub token_header: String,
    pub form_field: String,
    pub cookie_name: String,
    pub safe_methods: Vec<String>,
    pub exempt_paths: Vec<String>,
}

CSRF (Cross-Site Request Forgery) protection configuration.

When enabled, mutating requests (POST, PUT, DELETE, PATCH) must include a valid CSRF token either as:

• An HTTP header (default: X-CSRF-Token)
• A form field (default: _csrf)

The token is generated per-session and stored in a cookie.

Defaults

Field	Default
enabled	false
token_header	"X-CSRF-Token"
form_field	"_csrf"
cookie_name	"autumn-csrf"
safe_methods	["GET", "HEAD", "OPTIONS", "TRACE"]
exempt_paths	[]

Examples

[security.csrf]
enabled = true
token_header = "X-XSRF-Token"
cookie_name = "XSRF-TOKEN"
exempt_paths = ["/api/"]

Fields

enabled: bool

Enable CSRF protection. Default: false.

Enabled automatically for prod profile via smart defaults.

token_header: String

HTTP header name for the CSRF token. Default: "X-CSRF-Token".

form_field: String

Form field name for the CSRF token. Default: "_csrf".

cookie_name: String

Cookie name for storing the CSRF token. Default: "autumn-csrf".

safe_methods: Vec<String>

HTTP methods that do NOT require CSRF validation. Default: ["GET", "HEAD", "OPTIONS", "TRACE"].

exempt_paths: Vec<String>

Request path prefixes that are exempt from CSRF validation. Default: [].

Use this to opt JSON API routes out of CSRF when they authenticate with bearer tokens or other non-cookie credentials. Matches are by prefix on the request path, e.g. "/api/" exempts all routes under /api/.

Trait Implementations

impl Clone for CsrfConfig

fn clone(&self) -> CsrfConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CsrfConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CsrfConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for CsrfConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.