Struct CsrfOrigin 

pub struct CsrfOrigin { /* private fields */ }

Rejects cross-site state-changing requests by checking their origin.

Browsers attach cookies to requests a hostile page triggers, so a route that authenticates with cookies (or HTTP Basic) needs this check. For every method except GET, HEAD, OPTIONS and TRACE:

1. Sec-Fetch-Site: cross-site is rejected, even when Origin would match; Sec-Fetch-Site: same-origin is accepted.
2. Otherwise Origin must equal one of the configured origins. When Origin is absent the origin of Referer is used instead.
3. Origin: null, a missing Origin and Referer, repeated headers and any other origin are rejected.

A rejection is one generic 403 problem that does not say which check failed. The allowed origins are configuration only: they are never derived from Host or X-Forwarded-*, which a client can choose.

use siderite_core::middleware::CsrfOrigin;

let csrf = CsrfOrigin::new(["https://app.example.com"])?
    .exempt("/webhooks/");

Implementations

impl CsrfOrigin

pub fn new<I, S>(origins: I) -> Result<Self, CsrfOriginError>

where I: IntoIterator<Item = S>, S: AsRef<str>,

Allow the given exact origins.

Each origin is scheme://host[:port] with an http or https scheme and no path, query, fragment or user info. It is lowercased and a default port (80 for http, 443 for https) is removed, so HTTPS://App.Example.com:443 equals https://app.example.com.

Errors

CsrfOriginError for the first origin that does not parse.

pub fn exempt(self, prefix: impl Into<String>) -> Self

Skip the check for paths under prefix, for example a webhook.

The prefix matches whole path segments: /hooks covers /hooks and /hooks/x but not /hooksy. A prefix not starting with / never matches, and paths with . or .. segments are never exempt. Exempt routes must authenticate callers some other way, for example by verifying a signature.

pub fn only_with_cookie(self) -> Self

Check only requests that carry ambient credentials (default off).

When on, a request with no Cookie header and no Authorization: Basic is not checked. That suits APIs that accept both bearer tokens and cookies. The trade-off: a request that arrives without credentials is passed to the handler, so every route behind this setting must reject anonymous state changes itself, and any other credential a browser sends by itself would bypass the check.

Trait Implementations

impl Clone for CsrfOrigin

fn clone(&self) -> CsrfOrigin

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CsrfOrigin

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Layer<BoxCloneSyncService<Request<Body>, Response<Body>, Infallible>> for CsrfOrigin

type Service = BoxCloneSyncService<Request<Body>, Response<Body>, Infallible>

The wrapped service

fn layer(&self, inner: BoxService) -> Self::Service

Wrap the given service with the middleware, returning a new service that has been decorated with the middleware.