Crate tower_csrf 

Modern protection against cross-site request forgery (CSRF) attacks,

This is experimental middleware for Tower. It provides modern CSRF protection as outlined in a blogpost by Filippo Valsorda, discussing the research background for integrating CSRF protection in Go 1.25’s net/http.

This boils down to (quoting from the blog):

1. Allow all GET, HEAD, or OPTIONS requests
2. If the Origin header matches an allow-list of trusted origins, allow the request
3. If the Sec-Fetch-Site header is present and the value is same-origin or none, allow the request, otherwise reject
4. If neither the Sec-Fetch-Site nor the Origin headers are present, allow the request
5. If the Origin header’s host (including the port) matches the Host header, allow the request, otherwise reject it

The crate uses tracing to log passed requests and configuration changes. Errors are not logged, just pass through the chain.

Structs

CrossOriginProtectionLayer

Decorates a HTTP service with CSRF protection.

CrossOriginProtectionMiddleware

CSRF protection middleware for HTTP requests.

Enums

ConfigError

Errors that can occur during configuration of the layer.

ProtectionError

Errors that can occur during request processing of the middleware.