Crate sova_csrf 

CSRF protection via session double-submit (Laravel-style).

Install after sessions. Mutating requests are checked for a matching token in (order): X-CSRF-TOKEN → X-XSRF-TOKEN → query field → application/x-www-form-urlencoded body field. Multipart bodies are left to handlers (CsrfExt::verify_csrf) unless the header/query carries the token.

With Csrf::xsrf_cookie (default on), each response also gets a readable XSRF-TOKEN cookie so SPA clients (axios) can send X-XSRF-TOKEN.

Structs

Csrf

Session double-submit CSRF plugin.

CsrfMismatch

Fired before a 403 response for CSRF mismatch or missing token.

CsrfToken

Per-request token placed by middleware / CsrfExt::csrf_token.

Traits

CsrfExt

Request helpers for CSRF tokens.