csrf_filter.hpp

浏览该文件的文档.

#ifndef NEFORCE_NETWORK_HTTP_CSRF_FILTER_HPP__
#define NEFORCE_NETWORK_HTTP_CSRF_FILTER_HPP__

 
#include "NeForce/core/async/mutex.hpp"
#include "NeForce/network/http/http_filter.hpp"
#include "NeForce/network/http/http_session.hpp"
NEFORCE_BEGIN_NAMESPACE__
NEFORCE_BEGIN_HTTP__


class NEFORCE_API csrf_filter final : public http_filter {
public:
    string cookie_name{"XSRF-TOKEN"};   
    string header_name{"X-CSRF-Token"}; 
    string form_field_name{"_csrf"};    
    seconds token_max_age{3600};        
    bool enabled{true};                 
 
    csrf_filter() = default;
 
    bool pre_filter(http_request& request, http_response& response) override;
    void do_filter(http_request& /*request*/, http_response& /*response*/) override {}
 
    NEFORCE_NODISCARD string name() const override { return "csrf_filter"; }
 
    // TODO: Synchronizer Token pattern — server-side token storage (in addition to Double-Submit Cookie) for stricter CSRF enforcement
};
 // HTTP
 
NEFORCE_END_HTTP__
NEFORCE_END_NAMESPACE__
#endif // NEFORCE_NETWORK_HTTP_CSRF_FILTER_HPP__