Web.Wheb.Plugins.Security

Provides middleware and view protection against CSRF attacks. To ensure maximum protection, turn on the setting "enable-secure-cookies".

Documentation

csrfMiddleware :: MonadIO m => WhebHandlerT g s m -> WhebMiddleware g s m

A middleware to protect ALL incoming POST requests aginst CSRF, throwing the handler upon failure

csrfProtect :: MonadIO m => WhebHandlerT g s m -> WhebHandlerT g s m -> WhebHandlerT g s m

Takes a handler to throw when CSRF fails and a handler to run when it succeeds

csrfPassed :: MonadIO m => WhebT a b m Bool

CSRF reads a cookie value ("csrf_token") and compares it to either submitted post data (param "csrf_token") or request header (X-CSRF-TOKEN)

getCSRFToken :: MonadIO m => WhebT a b m Text

This will get or generate and set a new CSRF Token in the Cookies