chickadee » schematra-csrf » csrf-middleware

csrf-middlewareprocedure

Creates CSRF protection middleware for Schematra applications. This middleware automatically protects against Cross-Site Request Forgery attacks by validating CSRF tokens on unsafe HTTP methods.

Behavior:

  • Safe methods (GET, HEAD, OPTIONS, TRACE) pass through without validation
  • Unsafe methods (POST, PUT, DELETE, PATCH) require a valid CSRF token
  • Missing or invalid tokens result in a 403 Forbidden response

The middleware looks for CSRF tokens in two places:

  1. Form data using the field name from csrf-form-field parameter
  2. HTTP header X-CSRF-Token
;; Enable CSRF protection globally
(use-middleware! (csrf-middleware))

;; Custom configuration
(csrf-form-field 'authenticity_token)
(csrf-token-key "my-csrf-key")
(use-middleware! (csrf-middleware))