CSRF


Logic behind CSRF token creation and verification.

Read Understanding-CSRF
for more information on CSRF. Use this module to create custom CSRF middleware.

Looking for a CSRF framework for your favorite framework that uses this
module?

* Express/connect: csurf or
alt-xsrf
* Koa: koa-csrf or
koa-atomic-session

This module is a fork of https://github.com/pillarjs/csrf at f0d66c91ea4be6d30a03bd311ed9518951d9c3e4.

$3

``sh
$ npm i @fastify/csrf
`

$3

This module includes a TypeScript
declaration file to enable auto-complete in compatible editors and type
information for TypeScript projects.

API

`js
const Tokens = require('@fastify/csrf')
`

$3

Create a new token generation/verification instance. The options argument is
optional and will just use all defaults if missing.

#### Options

Tokens accept these properties in the options object.

##### algorithm

The hash-algorithm to generate the token. Defaults to sha256.

##### saltLength

The length of the internal salt to use, in characters. Internally, the salt
is a base 62 string. Defaults to 8 characters.

##### secretLength

The length of the secret to generate, in bytes. Note that the secret is
passed around base-64 encoded and that this length refers to the underlying
bytes, not the length of the base-64 string. Defaults to 18 bytes.

##### userInfo

Require user-specific information in tokens.create() and
tokens.verify().

##### hmacKey

When set, the hmacKey is used to generate the cryptographic HMAC hash instead of the default hash function.

##### validity

The maximum validity of the token to generate, in milliseconds. Note that the epoch is
passed around base-36 encoded. Defaults to 0 milliseconds (disabled).

#### tokens.create(secret[, userInfo])

Create a new CSRF token attached to the given secret. The secret is a
string, typically generated from the tokens.secret() or tokens.secretSync()
methods. This token is what you should add into HTML