class Grip::Middleware::CrossSiteRequestForgery

• Grip::Middleware::CrossSiteRequestForgery
• Reference
• Object

Included Modules

• HTTP::Handler

Defined in:

grip/middleware/cross_site_request_forgery.cr

Constant Summary

CHECK_METHODS = ["PUT", "POST", "PATCH", "DELETE"] of ::String

COOKIE_KEY = "csrf_token"

HEADER_KEY = "X-CSRF-Token"

PARAM_KEY = "_csrf"

TOKEN_LENGTH = 32

Constructors

• .new(secret : String, secure : Bool = true)

Class Method Summary

• .existing_token(context) : Bytes | Nil

  Returns the raw token from a valid signed cookie, or nil

• .mask(raw : Bytes) : String

  XORs the raw token with a random one-time pad (pad + ciphertext), mitigating BREACH

• .metatag(context : HTTP::Server::Context) : String

  Meta tag so JavaScript can read the token and send it as a header

• .raw_token(context) : Bytes

  Returns the raw token, issuing a new cookie if the client has none

• .secret : String
• .secret=(secret : String)
• .secure=(secure : Bool)
• .secure? : Bool
• .tag(context : HTTP::Server::Context) : String

  Hidden input for HTML forms

• .token(context : HTTP::Server::Context) : String

  Masked token, different on every call; safe to embed in HTML

• .unmask(masked : Bytes) : Bytes

  Reverses mask by XORing the ciphertext with the pad that prefixes it

• .valid?(raw : Bytes, sent : String) : Bool

  Unmasks the submitted token and compares it to the raw token in constant time

Instance Method Summary

• #call(context : HTTP::Server::Context)

  Rejects unsafe requests whose submitted token doesn't match the cookie token

Constructor Detail

Class Method Detail

Instance Method Detail