{"repo":"juanbzz/next-csrf","free":true,"listed":false,"github":"https://github.com/juanbzz/next-csrf","clone":"git clone https://github.com/juanbzz/next-csrf.git","description":"CSRF mitigation for Next.js","language":"TypeScript","stars":142,"topics":["csrf","csrf-protection","nextjs","next","node","security"],"license":"MIT","category":"security-tools","readme_excerpt":"next-csrf CSRF mitigation for Next.js. Features Mitigation patterns that next-csrf implements: Synchronizer Token Pattern using csrf (Also read Understanding CSRF) Installation With yarn: With npm: Usage Create an initialization file to add options: Protect an API endpoint: Test the protected API route by sending a POST request from your terminal. Since this request doesn't have the proper token setup, it wil fail. Use an SSG page to set up the token. Usually, you use CSRF mitigation to harden your requests from authenticated users, if this is the case then you should use the login page. API nextCsrf(options); Returns two functions: setup Setups two cookies, one for the secret and other one for the token. Only works on SSG pages. csrf Protects API routes from requests without the token. Validates and verify signatures on the cookies. options tokenKey ( string ) The name of the cookie to store the CSRF token. Default is \"XSRF-TOKEN\" . csrfErrorMessage ( string ) Error message to return for unauthorized requests. Default is \"Invalid CSRF token\" . ignoredMethods : ( string[] ) Methods to ignore, i.e. let pass all requests with these methods. Default is [\"GET\", \"HEAD\", \"OPTIONS\"] . cookieOptions : Same options as https://www.npmjs.com/package/cookie","default_branch":null,"files":null,"tree":[],"storefront":"/r/juanbzz","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/juanbzz/next-csrf/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}