Struct CsrfMiddleware 

pub struct CsrfMiddleware { /* private fields */ }

CSRF protection middleware

Validates CSRF tokens on state-changing requests (POST, PUT, PATCH, DELETE).

Token Sources

The middleware looks for the CSRF token in the following order:

1. X-CSRF-TOKEN header (used by Inertia.js)
2. X-XSRF-TOKEN header (Laravel convention)
3. _token form field (traditional forms)

Usage

use ferro_rs::{global_middleware, CsrfMiddleware};

global_middleware!(CsrfMiddleware::new());

Implementations

impl CsrfMiddleware

pub fn new() -> Self

Create a new CSRF middleware with default settings

Protects: POST, PUT, PATCH, DELETE

pub fn except(self, paths: Vec<impl Into<String>>) -> Self

Add paths to exclude from CSRF validation

Useful for webhooks or API endpoints that use other authentication.

Example

let csrf = CsrfMiddleware::new()
    .except(vec!["/webhooks/*", "/api/external/*"]);

Trait Implementations

impl Default for CsrfMiddleware

fn default() -> Self

Returns the “default value” for a type.

impl Middleware for CsrfMiddleware

fn handle<'life0, 'async_trait>( &'life0 self, request: Request, next: Next, ) -> Pin<Box<dyn Future<Output = Response> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Handle the request