CsrfMiddleware class

Stops cross site request forgery (CSRF).

A POST, PUT, PATCH or DELETE request must send the CSRF token of the session, in the _token body field or the X-CSRF-TOKEN or X-XSRF-TOKEN header. Else Dox answers 419.

It also sets the XSRF-TOKEN cookie. Page scripts can read it. axios and Inertia send it back in X-XSRF-TOKEN for you. Put it after SessionMiddleware.

CsrfMiddleware(except: <String>['/api/*', '/webhooks/stripe']);

Implemented types

• IDoxNextMiddleware

Constructors

CsrfMiddleware({List<String> except = const <String>[]})

const

Properties

except → List<String>

Paths with no check. A * at the end matches the rest of the path.

final

hashCode → int

The hash code for this object.

no setter, inherited

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

Methods

handle(DoxRequest req, Next next) → Future<DoxResponse>

override

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

toString() → String

A string representation of this object.

inherited

Operators

operator ==(Object other) → bool

The equality operator.

inherited

Constants

cookieName → const String

the name of the cookie that page scripts read