Plug.CSRFProtection

Plug to protect from cross-site request forgery.

For this plug to work, it expects a session to have been previously fetched. If a CSRF token in the session does not previously exist, a CSRF token will be generated and put into the session.

When a token is invalid, an InvalidCSRFTokenError error is raised.

The session’s CSRF token will be compared with a token in the params with key “csrf_token” or a token in the request headers with key “x-csrf-token”.

Only GET and HEAD requests are unprotected.

Javascript GET requests are only allowed if they are XHR requests. Otherwise, an InvalidCrossOriginRequestError error will be raised.

You may disable this plug by doing Plug.Conn.put_private(:plug_skip_csrf_protection, true).

Examples

plug Plug.CSRFProtection

Summary

call(conn, opts)
init(opts)
mark_for_cross_origin_check(conn)

Functions

call(conn, opts)
init(opts)
mark_for_cross_origin_check(conn)