Struct salvo_extra::csrf::CsrfHandler

pub struct CsrfHandler { /* fields omitted */ }

Cross-Site Request Forgery (CSRF) protection middleware.

Implementations

impl CsrfHandler

pub fn new(secret: &[u8]) -> Self

Create a new instance.

Defaults

The defaults for CsrfHandler are:

• cookie path: /
• cookie name: salvo.extra.csrf
• cookie domain: None
• ttl: 24 hours
• header name: x-csrf-token
• query param: csrf-token
• form field: csrf-token
• protected methods: [POST, PUT, PATCH, DELETE]

pub fn with_ttl(self, ttl: Duration) -> Self

Sets the protection ttl. This will be used for both the cookie expiry and the time window over which CSRF tokens are considered valid.

The default for this value is one day.

pub fn with_header_name(self, header_name: HeaderName) -> Self

Sets the name of the HTTP header where the middleware will look for the CSRF token.

Defaults to “x-csrf-token”.

pub fn with_query_param(self, query_param: impl AsRef<str>) -> Self

Sets the name of the query parameter where the middleware will look for the CSRF token.

Defaults to “csrf-token”.

pub fn with_form_field(self, form_field: impl AsRef<str>) -> Self

Sets the name of the form field where the middleware will look for the CSRF token.

Defaults to “csrf-token”.

pub fn with_protected_methods(self, methods: &[Method]) -> Self

Sets the list of methods that will be protected by this middleware

Defaults to [POST, PUT, PATCH, DELETE]

Trait Implementations

impl Debug for CsrfHandler

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Handler for CsrfHandler

fn handle<'life0, 'life1, 'life2, 'life3, 'life4, 'async_trait>(
    &'life0 self,
    req: &'life1 mut Request,
    depot: &'life2 mut Depot,
    res: &'life3 mut Response,
    ctrl: &'life4 mut FlowCtrl
) -> Pin<Box<dyn Future<Output = ()> + Send + 'async_trait>> where
    'life0: 'async_trait,
    'life1: 'async_trait,
    'life2: 'async_trait,
    'life3: 'async_trait,
    'life4: 'async_trait,
    Self: 'async_trait, 

Handle http request.