Expand description
CSRF protection via the double-submit-cookie pattern.
A random token is placed in a csrf_token cookie and echoed back by the
client in the X-CSRF-Token header (or a form field). The [with_csrf]
middleware (see crate::stack::MiddlewareStack) requires the two to match
on state-changing requests, so a cross-site request — which cannot read the
cookie to echo it — is rejected.
Functions§
- generate_
token - Mint a fresh, unguessable CSRF token (256 bits of randomness, hex-encoded).
- tokens_
match - Constant-time comparison of a stored token and a submitted one.