A Bucketchain middleware for stateless CSRF protection without token.
$ bower install purescript-bucketchain-csrf
$ spago install bucketchain-csrf
server :: Effect Server
server = createServer $ middleware1 <<< middleware2
middleware1 :: Middleware
middleware1 = withCSRFProtection
{ host: "example.oreshinya.xyz"
, origins: [ "http://example.oreshinya.xyz" ]
}
middleware2 :: Middleware
middleware2 next = do
http <- ask
case requestMethod http, requestURL http of
"POST", "/test" ->
liftEffect $ Just <$> body "This is test."
"GET", "/" ->
liftEffect $ Just <$> body "This is text."
_, _ ->
nextThis middleware needs 3 headers:
Host: Browsers send it automatically.X-From: You should send all request with this header.Origin: Browsers send it automatically.
Module documentation is published on Pursuit.
MIT