Usage#
typescript
import { csrf } from '@AxilJS/security'
app.use(csrf())How it works#
- Server sets a random token as a cookie
- Client sends the token as
x-csrf-tokenheader - Server compares using constant-time comparison
Safe methods (GET, HEAD, OPTIONS) skip validation.
Warning
Token comparison uses constant-time comparison to prevent timing attacks.