Crate axum_csrf_simple 

Structs

CSRFToken

Represents a CSRFToken. You can use request extension to get it. If you enable CSRF protection, the extension will guarantee the CSRF token is either Freshly initialized and cookie is set Or cookie seen, cookie value is valid, so we reuse the cookie

CSRFTokenFromRequest

Represents a CSRFToken from x-csrf-token request header. If it is available, it will be availabe for you to use using the auto extractor.

Functions

csrf_protect

Middleware to protect CSRF

generate_csrf_token

Generate a CSRF token in format of xxxx-yyyy xxxx is the short uuid generated using uuid-short. yyyy is the hmac signature of the uuid-short signed with the sign key set previously (or default 32 char random key if not set)

generate_random_string

Generate a random string of size Possible keys are from alpha numeric, mixing upper/lower cases

get_csrf_token

A handler for you to expose to client. You should expose to client using your router.

set_csrf_secure_cookie_enable

Enable or disable secure cookie. Default is to disable so it works with HTTP and HTTPS. Enabling secure cookie will make it only works with HTTPS Default is disabled

set_csrf_token_sign_key

Set the signing key for csrf token. If not called, CSRF token will be signed by a random 32 char alphanumeric string. Recommend to set a key with at least 32 characters. Better to call before your server start. Otherwise some existing CSRF token will become invalid.

sign_message

Sign a message with the previously set sign key. Used internally, but you could use it elsewhere too. Return hex encoded signed message

validate_csrf_token

Given a CSRF key of xxx-yyy format, use the previously set sign key to validate the value. Return true if the token is valid and signature matches

verify_signature

This is a verification function for sign_message. You can give input text, and a signature. The code will in computed signature to match the signature and return true if signature maches.