checkCsrf

Decides whether a request may change state. Browsers label every request: the decision uses Sec-Fetch-Site first, then Origin, then Referer, and rejects a request that carries none of them unless allowMissingOrigin is set. Safe methods (GET, HEAD, OPTIONS) always pass. A cross-site request passes only when its Origin is a trusted origin.

Import#

import { checkCsrf } from "@shadow-js/dusk/server";

Signature#

function checkCsrf(request: Request, context: CsrfContext): CsrfDecision

Parameters#

Returns#

The decision and the reason, for tests and logs.

Examples#

checkCsrf(request, { origin: "https://app.test", trustedOrigins: new Set(), allowMissingOrigin: false });