Product
Introducing License Enforcement in Socket
Ensure open-source compliance with Socket’s License Enforcement Beta. Set up your License Policy and secure your software!
nuxt-csurf
Advanced tools
Cross-Site Request Forgery (CSRF) prevention.
Create a middleware for CSRF token creation and validation.
✅ Supports Node.js server & serverless environments
✅ Supports both universal and client-side rendering (ssr: true|false
)
✅ TypeScript
yarn add nuxt-csurf # yarn
npm i nuxt-csurf # npm
The only thing you need to do to use the module in the default configuration is to register the module in the modules
array in nuxt.config.ts
:
// nuxt.config.js
{
modules: [
"nuxt-csurf",
],
csurf: { // optional
https: false, // default true if in production
cookieKey: '', // "__Host-csrf" if https is true otherwise just "csrf"
cookie: { // CookieSerializeOptions from unjs/cookie-es
path: '/',
httpOnly: true,
sameSite: 'strict'
},
methodsToProtect: ['POST', 'PUT', 'PATCH'], // the request methods we want CSRF protection for
excludedUrls: ['/nocsrf1', ['/nocsrf2/.*', 'i']], // any URLs we want to exclude from CSRF protection
encryptSecret: /** a 32 bits secret */, // only for non serverless runtime, random bytes by default
encryptAlgorithm: 'aes-256-cbc', // by default 'aes-256-cbc' (node), 'AES-CBC' (serverless)
addCsrfTokenToEventCtx: true // default false, to run useCsrfFetch on server set it to true
}
}
This composable provides a convenient wrapper around useFetch
. It automatically adds the CSRF token in headers.
const { data, pending, error, refresh } = useCsrfFetch('/api/login', { query: param1: 'value1' })
This helper provides a convenient wrapper around $fetch
. It automatically adds the CSRF token in headers.
const { $csrfFetch } = useNuxtApp()
const { data } = await $csrfFetch('/api/login', { method: 'POST', body: …, headers: … })
Use this composable if you need to access to the CSRF token value.
const { csrf } = useCsrf()
console.log(csrf) // something like: mo4+MrFaeXP7fhAie0o2qw==:tLUaqtHW6evx/coGQVAhtGAR+v6cxgFtrqmkOsuAMag8PHRnMwpbGGUO0TPJjL+4
FAQs
Nuxt Cross-Site Request Forgery (CSRF) Prevention
The npm package nuxt-csurf receives a total of 41,591 weekly downloads. As such, nuxt-csurf popularity was classified as popular.
We found that nuxt-csurf demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Product
Ensure open-source compliance with Socket’s License Enforcement Beta. Set up your License Policy and secure your software!
Product
We're launching a new set of license analysis and compliance features for analyzing, managing, and complying with licenses across a range of supported languages and ecosystems.
Product
We're excited to introduce Socket Optimize, a powerful CLI command to secure open source dependencies with tested, optimized package overrides.