module Roda::RodaPlugins::Csrf

  1. lib/roda/plugins/csrf.rb

This plugin is no longer recommended for use, it exists only for backwards compatibility. Consider using the route_csrf plugin instead, as that provides stronger CSRF protection. This plugin will no longer ship with Roda starting in Roda 4.

The csrf plugin adds CSRF protection using rack_csrf, along with some csrf helper methods to use in your views. To use it, load the plugin, with the options hash passed to Rack::Csrf:

plugin :csrf, raise: true

Optionally you can choose not to setup rack_csrf middleware on the roda app if you already have one configured:

plugin :csrf, skip_middleware: true

This adds the following instance methods:

csrf_field

The field name to use for the hidden/meta csrf tag.

csrf_header

The http header name to use for submitting csrf token via headers (useful for javascript).

csrf_metatag

An html meta tag string containing the token, suitable for placing in the page header

csrf_tag

An html hidden input tag string containing the token, suitable for placing in an html form.

csrf_token

The value of the csrf token, in case it needs to be accessed directly.

Methods

Public Class

  1. configure

Constants

CSRF = ::Rack::Csrf  

Public Class methods

configure(app, opts={})

Load the Rack::Csrf middleware into the app with the given options.

[show source] 
   # File lib/roda/plugins/csrf.rb
40 def self.configure(app, opts={})
41   return if opts[:skip_middleware]
42   app.instance_exec do
43     @middleware.each do |(mid, *rest), _|
44       if mid.equal?(CSRF)
45         rest[0].merge!(opts)
46         build_rack_app
47         return
48       end
49     end
50     use CSRF, opts
51   end
52 end