Aino.Session.CSRF (aino v0.7.0)
Session Middleware for handling CSRF validation
Example for using CSRF:
middleware = [
Aino.Middleware.common(),
&Aino.Session.config(&1, %Aino.Session.Cookie{key: "key", salt: "salt"}),
&Aino.Session.decode/1,
&Aino.Session.Flash.load/1,
&Aino.Middleware.Routes.routes(&1, routes()),
&Aino.Middleware.Routes.match_route/1,
&Aino.Middleware.params/1,
&Aino.Session.CSRF.validate/1,
&Aino.Session.CSRF.generate/1,
&Aino.Middleware.Routes.handle_route/1,
&Aino.Session.encode/1,
&Aino.Middleware.logging/1
]
Aino.Token.reduce(token, middleware)
validate/1
and generate/1
should be after Session.load/1
and
Aino.Middleware.params/1
to make sure the token can be properly loaded.
Your forms must now include a new hidden field named _csrf_token
. This will
use the session's _csrf_token
value.
<input type="hidden" name="_csrf_token" value="<%= @token.session["_csrf_token"] %>" />
Summary
Functions
Link to this function
generate(token)
Generate a token and store in the session
Link to this function
validate(token)
Validate the token is present if a POST or PUT