Csrf

The CSRF token: what a form carries and an unsafe request must return, proving the submission came from a page this application served to this browser and not from a stranger's.

One per session, in a reserved entry beside the flash, so the token is as private as the cookie that carries it and lives as long. Not a second cookie, because the session is already signed and the double submit pattern exists for frameworks whose session is server side; not one per form, because that breaks the back button and a second tab. Sent as is rather than masked: masking defends against BREACH, which needs response compression, and eezo compresses nothing. The day gzip arrives, masking is added here alone.

Both halves happen at dispatch, after a route has matched and before its handler runs, and protect is where: it mints a token into a session that has none, so every request past dispatch has one and reading it cannot fail, and it refuses a POST, PUT, PATCH or DELETE whose form does not return the session's token, derived and handwritten alike. The one place the token does not apply is an API route, where no session takes part: a program holds no session to keep a token in and serves no page to embed one, and the route's Guarded says who may call it instead. A route is an API route only when its handler takes an ApiRequest, so a page that reads the session cannot drop the check without its type saying so. The safe methods, GET, HEAD and OPTIONS, are never checked; a WebSocket upgrade is a GET. Only the form field is read: a header for JavaScript waits until an example fetches.