Beignet API reference
    Preparing search index...

    Interface CsrfHooksOptions

    Options for createCsrfHooks(...).

    interface CsrfHooksOptions {
        allowMissingOrigin?: boolean;
        protectedMethods?: readonly string[];
        skip?: (
            args: {
                contract: HttpContractConfig;
                params: Record<string, string>;
                req: HttpRequestLike;
            },
        ) => boolean
        | Promise<boolean>;
        token?: false | CsrfTokenOptions;
        trustedOrigins?:
            | readonly string[]
            | (
                (
                    args: {
                        contract: HttpContractConfig;
                        origin: string;
                        req: HttpRequestLike;
                    },
                ) => boolean
            );
        trustedProxy?: TrustedProxyConfig;
    }
    Index
    allowMissingOrigin? protectedMethods? skip? token? trustedOrigins? trustedProxy?
    allowMissingOrigin?: boolean

    Whether unsafe requests without Origin or Referer are allowed.

    Defaults to true so server-to-server calls, tests, and older same-origin clients keep working. Set to false for cookie-backed browser-only APIs.

    protectedMethods?: readonly string[]

    Unsafe HTTP methods protected by the hook.

    Defaults to POST, PUT, PATCH, and DELETE.

    skip?: (
        args: {
            contract: HttpContractConfig;
            params: Record<string, string>;
            req: HttpRequestLike;
        },
    ) => boolean
    | Promise<boolean>

    App-owned escape hatch for routes that have another verifier, such as provider webhooks or auth callbacks.

    token?: false | CsrfTokenOptions

    Optional double-submit cookie token check.

    When configured, protected requests must send the same token in the configured header and cookie.

    trustedOrigins?:
        | readonly string[]
        | (
            (
                args: {
                    contract: HttpContractConfig;
                    origin: string;
                    req: HttpRequestLike;
                },
            ) => boolean
        )

    Additional trusted origins allowed to send protected requests.

    The request URL's own origin is always trusted. Use this for sibling frontends such as https://app.example.com calling https://api.example.com.

    trustedProxy?: TrustedProxyConfig

    Hook-local trusted-proxy policy used when comparing the request's external origin against Origin or Referer. This overrides the server-level policy.

    Configure this only when the app is always behind a platform or reverse proxy that strips or normalizes forwarding headers. Without this option, CSRF uses the requestInfo resolved by createServer(...).

    Settings
    Member Visibility

    On This Page
    Properties