AuthBrowserProtectionValidator class

Comprehensive browser-request validator for auth routes.

This validator combines multiple defense layers:

• Origin header validation
• Fetch Metadata site checks; mode and destination headers are observed but do not currently affect the decision
• Referrer header validation as fallback
• Trusted-origin policy enforcement
• Content-Type validation for state-changing requests

Constructors

AuthBrowserProtectionValidator({required AuthBrowserProtectionOptions options, AuthCookiePolicy cookiePolicy = AuthCookiePolicy.production, Set<String> allowedContentTypes = const {'application/json', 'application/x-www-form-urlencoded', 'multipart/form-data'}})

Creates a validator from browser options and cookie policy settings.

const

Properties

allowedContentTypes → Set<String>

Allowed content types for state-changing requests.

final

cookiePolicy → AuthCookiePolicy

Cookie security policy.

final

hashCode → int

The hash code for this object.

no setter, inherited

options → AuthBrowserProtectionOptions

Browser protection options.

final

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

Methods

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

toString() → String

A string representation of this object.

inherited

validate({required Uri requestUri, required HttpHeaders headers, required String method}) → BrowserValidationResult

Validates a browser request and returns the first failed check.

Operators

operator ==(Object other) → bool

The equality operator.

inherited