bx-csrf

Name: bx-csrf
Availability: InStock
Author: BoxLang

Generate, verify, and rotate CSRF tokens for BoxLang web applications.

Updated Apr 10, 2026

Search Tags:#security #csrf #web-apps #token-verification #token-generation #scoped-tokens

Ready to run

npx skills add https://github.com/ortus-boxlang/skills --skill bx-csrf

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: bx-csrf
Source: https://github.com/ortus-boxlang/skills/tree/main/boxlang-modules/bx-csrf
Command: npx skills add https://github.com/ortus-boxlang/skills --skill bx-csrf

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Provides Cross-Site Request Forgery protection for BoxLang web applications by generating, validating, rotating, and scoping tokens to secure state-changing requests.

Core Features & Use Cases

Generate tokens with CSRFGenerateToken([key]) for forms or API calls and optionally scope by key.
Verify tokens with CSRFVerifyToken(token, [key]) to guard state-changing actions.
Render tokens as hidden fields via CSRFHiddenField([key], [forceNew]).
Rotate all tokens with CSRFRotate() to invalidate existing sessions.
Use per-form/scoped tokens, header-based verification for AJAX, and automatic verification if configured.

Quick Start

Install the bx-csrf module and start using CSRFGenerateToken() to issue tokens and CSRFVerifyToken() to validate them.

Frequently Asked Questions about bx-csrf

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I add CSRF protection to BoxLang web apps?▼

To add CSRF protection to BoxLang web apps, install the bx-csrf module and use CSRFGenerateToken() to issue tokens for forms or API calls, then validate them with CSRFVerifyToken() to guard state-changing actions.

Can I scope CSRF tokens to individual forms in BoxLang?▼

Yes, you can scope CSRF tokens to individual forms in BoxLang by passing an optional key parameter to the CSRFGenerateToken() and CSRFVerifyToken() functions, ensuring per-form token validation.

How do I verify CSRF tokens in AJAX or API requests?▼

You can verify CSRF tokens in AJAX or API requests using header-based verification, passing the generated token in the request header and validating it with CSRFVerifyToken() on the server side.

Does BoxLang support automatic CSRF token verification?▼

Yes, BoxLang supports automatic CSRF token verification by configuring the boxlang.json file with options for cache, expiry, and auto-verify to automatically guard state-changing operations.

How do I invalidate existing CSRF tokens in a BoxLang application?▼

To invalidate existing CSRF tokens in a BoxLang application, call the CSRFRotate() function, which rotates all active tokens and effectively invalidates existing sessions to secure state-changing requests.

What is the best way to render a CSRF token as a hidden form field?▼

The best way to render a CSRF token as a hidden form field is using the CSRFHiddenField() function, which optionally accepts a key for scoping and a forceNew parameter to generate a fresh token directly in the form markup.