Aino.Session.CSRF (aino v0.7.0)

Session Middleware for handling CSRF validation

Example for using CSRF:

middleware = [
  Aino.Middleware.common(),
  &Aino.Session.config(&1, %Aino.Session.Cookie{key: "key", salt: "salt"}),
  &Aino.Session.decode/1,
  &Aino.Session.Flash.load/1,
  &Aino.Middleware.Routes.routes(&1, routes()),
  &Aino.Middleware.Routes.match_route/1,
  &Aino.Middleware.params/1,
  &Aino.Session.CSRF.validate/1,
  &Aino.Session.CSRF.generate/1,
  &Aino.Middleware.Routes.handle_route/1,
  &Aino.Session.encode/1,
  &Aino.Middleware.logging/1
]

Aino.Token.reduce(token, middleware)

validate/1 and generate/1 should be after Session.load/1 and Aino.Middleware.params/1 to make sure the token can be properly loaded.

Your forms must now include a new hidden field named _csrf_token. This will use the session's _csrf_token value.

<input type="hidden" name="_csrf_token" value="<%= @token.session["_csrf_token"] %>" />

Summary

Functions

Generate a token and store in the session

Validate the token is present if a POST or PUT

Functions

Link to this function

generate(token)

Generate a token and store in the session

Link to this function

validate(token)

Validate the token is present if a POST or PUT