Struct CsrfMiddleware

pub struct CsrfMiddleware<S> { /* private fields */ }

This middleware is created by axum by applying the CsrfLayer. It verifies the CSRF token header on incoming requests, regenerates tokens as configured, and attaches the current token to the outgoing response.

In detail, this middleware receives a CSRF token as X-CSRF-TOKEN (if not custom configured with a different name) HTTP request header value and compares it to the token stored in the session.

Upon response from the inner service, the session token is returned to the client via the X-CSRF-TOKEN response header.

Make sure to expose this header in your CORS configuration if necessary!

Requires and uses axum_sessions.

Optionally regenerates the token from the session after successful verification, to ensure a new token is used for each writing (POST, PUT, DELETE) request. Enable with RegenerateToken::PerUse.

For maximum security, but severely reduced ergonomics, optionally regenerates the token from the session after each request, to keep the token validity as short as possible. Enable with RegenerateToken::PerRequest.

Implementations

impl<S> CsrfMiddleware<S>

pub fn new(inner: S, layer: CsrfLayer) -> Self

Create a new middleware from an inner tower::Service (axum-specific bounds, such as Infallible errors apply!) and a CsrfLayer. Commonly, the middleware is created by the tower::Layer - and never manually.

pub fn layer() -> CsrfLayer

Create a new CSRF synchronizer token layer. Equivalent to calling CsrfLayer::new().

Trait Implementations

impl<S: Clone> Clone for CsrfMiddleware<S>

fn clone(&self) -> CsrfMiddleware<S>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<S: Debug> Debug for CsrfMiddleware<S>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<S, B: Send + 'static> Service<Request<B>> for CsrfMiddleware<S>

where S: Service<Request<B>, Response = Response, Error = Infallible> + Send + Clone + 'static, S::Future: Send,

type Response = <S as Service<Request<B>>>::Response

Responses given by the service.

type Error = Infallible

Errors produced by the service.

type Future = Pin<Box<dyn Future<Output = Result<<CsrfMiddleware<S> as Service<Request<B>>>::Response, <CsrfMiddleware<S> as Service<Request<B>>>::Error>> + Send>>

The future response value.

fn poll_ready(&mut self, cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>>

Returns Poll::Ready(Ok(())) when the service is able to process requests.

fn call(&mut self, req: Request<B>) -> Self::Future

Process the request and return the response asynchronously.