Crate crissy

Crate crissy 

Source
Expand description

§crissy

crissy is a middleware for axum that protects (browser-facing) web resources from cross-site request forgery (CSRF) attacks.

§Usage

In short:

For example:

use axum::{
    Form, Router,
    response::{Html, IntoResponse},
    routing::get,
};
use crissy::CsrfToken;
use serde::Deserialize;
use tokio::net::TcpListener;

let app = Router::<()>::new()
    .route("/", get(route_index).post(route_post))
    .layer(axum::middleware::from_fn(crissy::middleware::cookie));
// Run `app` as usual

async fn route_index(csrf: CsrfToken) -> impl IntoResponse {
    Html(format!(
        r#"<form method="POST">
    <input type="hidden" name="csrf_token" value="{csrf}"/>
    <button type="submit">Submit</button>
</form>"#,
        csrf = csrf.expected_csrf_token,
    ))
}

#[derive(Deserialize)]
struct Body {
    csrf_token: String,
}
async fn route_post(csrf: CsrfToken, body: Form<Body>) -> Result<impl IntoResponse, crissy::Error> {
    csrf.validate(&body.csrf_token)?;
    Ok("validation successful!")
}

§Feature flags

crissy supports the following feature flags:

NameDefaultDescription
cookieYesmiddleware::cookie
client_ipNomiddleware::client_ip
fullNoEnables all feature flags.

Modules§

middleware
Users must use exactly one middleware from this module, which is responsible for generating and maintaining the CSRF tokens.

Structs§

CsrfToken
The client’s active CSRF token.

Enums§

Error