# @umajs/plugin-csrf

> Umajs CSRF plugin

Latest version **1.0.0-alpha.0** (published 2021-07-20) · ISC license · 0 weekly downloads

## Install

```sh
npm install @umajs/plugin-csrf
pnpm add @umajs/plugin-csrf
yarn add @umajs/plugin-csrf
bun add @umajs/plugin-csrf
```

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 1.0.0-alpha.0 |
| Published | 2021-07-20 |
| First published | 2021-07-14 |
| Weekly downloads | 0 |
| License | ISC |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 1 |
| Unpacked size | 4.6 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 3 |
| Author | hengg |
| Maintainers | wangliang826, liushaohua, edwwardzzz, dazjean, bubblelm, cocoboom |

## Links

- npm: https://www.npmjs.com/package/@umajs/plugin-csrf
- Repository: https://github.com/Umajs/plugin-csrf
- Homepage: https://github.com/Umajs/plugin-csrf#readme
- Issues: https://github.com/Umajs/plugin-csrf/issues
- npm.io page: https://npm.io/package/@umajs/plugin-csrf

## Dependencies (1)

- [csrf](https://npm.io/package/csrf.md) ^3.1.0

## Recent versions

- 1.0.0-alpha.0 (latest) — 2021-07-20
- 0.1.5 — 2021-07-16
- 0.1.4 — 2021-07-16
- 0.1.3 — 2021-07-16
- 0.1.2 — 2021-07-14
- 0.1.1 — 2021-07-14

## README

# @umajs/plugin-csrf

## Install
```
npm i @umajs/plugin-csrf
```

## Usage
`options`均为可选项
```js
// config/plugin.config.ts

import {TransType} from '../plugins/csrf'

export default {
    'csrf': {
        enable: true,
        options: {
            excludes: ['GET', 'HEAD', 'OPTIONS'], // 不进行校验的方法，默认['GET', 'HEAD', 'OPTIONS']
            tokenKey: 'your_csrf_token', // token key，默认uma_token
            secretKey: 'your_csrf_token_key', // 秘钥 key，默认uma_token_key
            ctxTokenKey: 'your_ctx_token_key', // token 挂载在ctx上的key，默认csrfToken
            maxAge: 30 * 86400 * 1000, // cookie 有效期，默认30 * 86400 * 1000
            transType:TransType.cookie, // 向服务器请求传递token的方式，包括 cookie、header和body三种方式，默认header
            withUid: true, // token 与 uid 关联，默认不关联
            uidKey: 'your_uid_key', // uid 挂载在ctx上的key，默认 uid
        },
    },
};

```

- 插件会将 token 通过 header、token key 通过 cookie 传递给前端；

- 前端获取header方式请参考：
    - [XHR getResponseHeader](https://developer.mozilla.org/zh-CN/docs/Web/API/XMLHttpRequest/getResponseHeader)
    - [fetch Response](https://developer.mozilla.org/zh-CN/docs/Web/API/Response)

- 前端在请求时，将token通过 cookie 或者 header 传递即可；

- 如果设置了token与uid关联，通过 Auth 获取到 uid 需要将其挂载在 ctx 上；

---
_Source: https://npm.io/package/@umajs/plugin-csrf · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._