CSRF Protection

Double-submit cookie CSRF prevention.

1 min readEdit this page

Usage

import { csrf } from '@restjs/security'
app.use(csrf())

How it works

  1. Server sets a random token as a cookie
  2. Client sends the token as x-csrf-token header
  3. Server compares using constant-time comparison

Safe methods (GET, HEAD, OPTIONS) skip validation.