csrf.h File Reference

CSRF protection via double-submit cookie pattern. More...

#include <cwist/sys/app/app.h>
#include <cwist/net/http/http.h>

Include dependency graph for csrf.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Functions
cwist_middleware_func	cwist_mw_csrf (cwist_app *app)
	CSRF middleware factory.
const char *	cwist_csrf_token (cwist_http_request *req)
	Get the CSRF token for the current request.

Detailed Description

CSRF protection via double-submit cookie pattern.

Definition in file csrf.h.

Function Documentation

cwist_csrf_token()

const char * cwist_csrf_token

(

cwist_http_request *

req

)

Get the CSRF token for the current request.

Useful for rendering forms or meta tags. Returns NULL if the middleware has not yet populated the token.

Parameters

req	Current request.

Returns

Token string, or NULL.

Get the CSRF token for the current request.

Parameters

req	Request to query.

Returns

The request's CSRF token, or NULL if req is NULL or no token has been set. The returned pointer is owned by the request.

Definition at line 240 of file csrf.c.

References cap, and cwist_http_request::csrf_token.

cwist_mw_csrf()

cwist_middleware_func cwist_mw_csrf

(

cwist_app *

app

)

CSRF middleware factory.

On safe requests (GET/HEAD/OPTIONS) a csrf_token cookie is issued if missing. On unsafe requests the X-CSRF-Token header, _csrf form field, or URL-encoded _csrf / csrf_token form field must match the cookie value. Query-string tokens are not accepted because URLs leak easily.

Parameters

app	Application context.

Returns

Middleware function pointer.

CSRF middleware factory.

Parameters

app	Application instance; unused.

Returns

The CSRF middleware handler function.

Definition at line 230 of file csrf.c.

References cap.