Config common to middleware, tokenFromRequestHeader and tokenFromRequestCookie.

Consider using defaultConfig and updating desired fields only.

Default CSRF settings.

• Cookie name is CSRF-TOKEN.
• Header name is X-CSRF-TOKEN.
• Reject with forbidden403 all request who are neither GET, HEAD, OPTIONS nor TRACE, unless the Token is present in both cookie and header and they are equal.

Obtain the Token from the Request headers.

You don't need to use this if you are using middleware.

Obtain the Token from the Request cookies.

You don't need to use this if you are using middleware.

Construct a SetCookie to set the CSRF Token.

The SetCookie has these settings, some of which could be overriden.

• Cookie name is Config's cookieName.
• HttpOnly: No, and you shouldn't change this.
• Max-Age and Expires: This cookie never expires. We recommend relying on server-side expiration instead, as the lifetime of the cookie could easily be extended by a legitimate but malicious client. It is recommended that you rotate the Token each time a new user session is established.
• Path: /
• SameSite: Lax.
• Secure: Yes.
• Domain: Not set.

Construct a SetCookie expiring the cookie named Config's cookieName.

Construct a Middleware (almost) that does the following:

1. Try to find the CSRF Token among the incoming Request cookies (see Config's cookieName).
2. Use Config's reject to decide if the incoming Request should be rejected.
3. If the Request wasn't rejected, we pass the Token found in the cookie, if any, to the underlying Application.

Important: This doesn't set any cookie. You must explicitly add setCookie to a Response yourself.

CSRF token.

• It is safe to send and receive the Token through HTTP cookies and headers.
• If you need to send or receive the Token as part of the request or response body, use MaskedToken instead.

A CSRF token is just random 32 bytes. Its meaning and validity depends on how and whether you tie it to a user session.

tokenFromBase64UU . tokenToBase64UU  ==  Just

tokenFromBase64UU . tokenToBase64UU  ==  Just

If you embed a Token as is in a response body when HTTP body compression is enabled, it is possible for a malicious actor to recover the Token through a BREACH attack or similar. In order to prevent that, send a different MaskedToken (generated with randomMaskToken) each time instead.

maskedTokenFromBase64UU . maskedTokenToBase64UU  ==  Just

maskedTokenFromBase64UU . maskedTokenToBase64UU  ==  Just

unmaskToken <$> randomMaskToken tok and pure tok produce the same output tok.

unmaskToken <$> randomMaskToken tok and pure tok produce the same output tok.