Struct poem::middleware::Csrf

pub struct Csrf { /* private fields */ }

This is supported on crate feature csrf only.

Middleware for Cross-Site Request Forgery (CSRF) protection.

Example

use poem::{
    get, handler,
    http::{header, Method, StatusCode},
    middleware::Csrf,
    post,
    web::{cookie::Cookie, CsrfToken, CsrfVerifier},
    Endpoint, EndpointExt, Error, Request, Result, Route,
};
use serde::Deserialize;

#[handler]
async fn login_ui(token: &CsrfToken) -> String {
    token.0.clone()
}

#[handler]
async fn login(verifier: &CsrfVerifier, req: &Request) -> Result<String> {
    let csrf_token = req
        .header("X-CSRF-Token")
        .ok_or_else(|| Error::from_status(StatusCode::UNAUTHORIZED))?;

    if !verifier.is_valid(&csrf_token) {
        return Err(Error::from_status(StatusCode::UNAUTHORIZED));
    }

    Ok(format!("login success"))
}

let app = Route::new()
    .at("/", get(login_ui).post(login))
    .with(Csrf::new());

let resp = app.call(Request::default()).await.unwrap();
assert_eq!(resp.status(), StatusCode::OK);
let cookie = resp.headers().get(header::SET_COOKIE).unwrap();
let cookie = Cookie::parse(cookie.to_str().unwrap()).unwrap();
let csrf_token = resp.into_body().into_string().await.unwrap();

let resp = app
    .call(
        Request::builder()
            .method(Method::POST)
            .header("X-CSRF-Token", csrf_token)
            .header(
                header::COOKIE,
                format!("{}={}", cookie.name(), cookie.value_str()),
            )
            .finish(),
    )
    .await
    .unwrap();
assert_eq!(resp.status(), StatusCode::OK);
assert_eq!(
    resp.into_body().into_string().await.unwrap(),
    "login success"
);

Implementations

impl Csrf

pub fn new() -> Self

Create Csrf middleware.

pub fn key(self, key: [u8; 32]) -> Self

Sets AES256 key to provide signed, encrypted CSRF tokens and cookies.

pub fn secure(self, value: bool) -> Self

Sets the Secure to the csrf cookie. Default is true.

pub fn http_only(self, value: bool) -> Self

Sets the HttpOnly to the csrf cookie. Default is true.

pub fn same_site(self, value: impl Into<Option<SameSite>>) -> Self

Sets the SameSite to the csrf cookie. Default is SameSite::Strict.

pub fn ttl(self, ttl: Duration) -> Self

Sets the protection ttl. This will be used for both the cookie expiry and the time window over which CSRF tokens are considered valid.

The default for this value is one day.

Trait Implementations

impl Default for Csrf

fn default() -> Self

Returns the “default value” for a type.

impl<E: Endpoint> Middleware<E> for Csrf

type Output = CookieJarManagerEndpoint<CsrfEndpoint<E>>

New endpoint type.

fn transform(&self, ep: E) -> Self::Output

Transform the input Endpoint to another one.