Module xsrf

XSRF protection middleware.

Proves to the server that a state-changing request comes from a document it served, rather than from a page merely riding the session cookie.

The convention is the one Angular established and servers widely implement: the server states the token in a script-readable XSRF-TOKEN cookie, the client echoes it in an X-XSRF-TOKEN field.

Usage

import { createFetch } from "@metreeca/http";
import { xsrf } from "@metreeca/http/xsrf";

const client = createFetch(xsrf());
Copy