wanda-csrf v0.1.1
wanda-csrf
Adds CSRF protection to your Wanda application.
Requires a session middleware to be initialized first.
Installation
Add this to your application's shard.yml
:
dependencies:
wanda-csrf:
github: TheEEs/wanda-csrf
Usage
Basic Use
require "wanda-csrf"
add_handler CSRF.new
You can also change the name of the form field, header name, the methods which don't need csrf,error message and routes which you don't want csrf to apply. All of these are optional
require "wanda-csrf"
add_handler CSRF.new(
header: "X_CSRF_TOKEN",
allowed_methods: ["GET", "HEAD", "OPTIONS", "TRACE"],
allowed_routes: ["/api/somecallback"],
parameter_name: "_csrf",
error: "CSRF Error"
)
If you need to have some logic within your error response, you can also pass it a proc (a pointer to a function)
require "wanda-csrf"
add_handler CSRF.new(
header: "X_CSRF_TOKEN",
allowed_methods: ["GET", "HEAD", "OPTIONS", "TRACE"],
allowed_routes: ["/api/somecallback"],
parameter_name: "_csrf",
error: ->myerrorhandler(HTTP::Server::Context)
)
def myerrorhandler(env)
if env.request.headers["Content-Type"]? == "application/json"
{"error" => "csrf error"}.to_json
else
"<html><head><title>Error</title><body><h1>You cannot post to this route without a valid csrf token</h1></body></html>"
end
end
Repository
wanda-csrf
Owner
Statistic
- 0
- 0
- 0
- 1
- 2
- about 5 years ago
- September 8, 2019
License
MIT License
Links
Synced at
Wed, 06 Nov 2024 19:15:03 GMT
Languages