salvo-csrf

Protect Salvo web applications from cross-site request forgery with token-based verification.

1|Updated Mar 16, 2024

Search Tags:#forms #session #web-security #token #csrf #cookie #salvo

Ready to run

npx skills add https://github.com/tdcare/genies --skill salvo-csrf-tdcare

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: salvo-csrf
Source: https://github.com/tdcare/genies/tree/main/.qoder/skills/salvo-csrf
Command: npx skills add https://github.com/tdcare/genies --skill salvo-csrf-tdcare

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

CSRF attacks are a common vector that can trick users into unintended actions. This Skill provides robust CSRF protection for Salvo-based web applications by enforcing token-based verification for state-changing requests.

Core Features & Use Cases

Cookie-based CSRF protection: Uses secure tokens stored in cookies to validate requests.
Session-backed CSRF: Integrates with session storage to maintain token state server-side.
Flexible token finders: Supports Form Finder, Header Finder, and Query Finder to extract tokens from different request parts.
Multi-method tokens: Supports bcrypt-based, HMAC, and AES-GCM token generation strategies for security requirements.
Easy integration: Works with Salvo routers and Depot to generate and validate tokens for forms and AJAX calls.

Quick Start

Integrate the CSRF middleware into your Salvo router and test by submitting a form from a different origin.

Frequently Asked Questions about salvo-csrf

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

When do I need CSRF middleware for Rust microservices using Salvo?▼

You need CSRF middleware for Rust microservices using Salvo when handling state-changing requests like form submissions and AJAX calls. It prevents cross-site request forgery attacks by enforcing token-based verification on vulnerable endpoints.

How does token-based CSRF verification work for form submissions?▼

Token-based CSRF verification secures state-changing requests by validating cryptographic, cookie-based, or session-backed tokens extracted via Form, Header, or Query finders. This prevents cross-site request forgery by ensuring requests originate from authenticated users.

Can I use CSRF protection with Salvo routers and Depot?▼

Yes, CSRF protection integrates easily with Salvo routers and Depot to generate and validate tokens. It applies to form submissions, state-changing endpoints, and AJAX requests within your Rust microservices.

What is the best way to secure AJAX requests in Salvo against cross-site request forgery?▼

The best way to secure AJAX requests in Salvo is applying CSRF middleware that uses flexible token finders like Header Finder. This enforces token-based verification for state-changing requests, preventing cross-site request forgery.

Do I need session storage to implement CSRF tokens in Salvo?▼

No, you do not need session storage to implement CSRF tokens in Salvo. You can use cookie-based tokens or cryptographic tokens with bcrypt, HMAC, or AES-GCM strategies as alternatives to session-backed validation.