@csrf-armor/core

@csrf-armor/core

The framework-agnostic engine behind CSRF Armor. It has no dependencies and uses only Web APIs, so it runs on Node.js and edge runtimes.

Using Next.js, Express or Nuxt? Install the adapter instead; it includes this package: @csrf-armor/nextjs · @csrf-armor/express · @csrf-armor/nuxt

Use the core directly to support another framework, or for the low-level token helpers.

Install

npm install @csrf-armor/core

Usage

Implement CsrfAdapter for your framework, then create a protector:

import { createCsrfProtection } from '@csrf-armor/core';

const csrf = createCsrfProtection(new MyFrameworkAdapter(), {
  secret: process.env.CSRF_SECRET,
});

const result = await csrf.protect(request, response);

if (!result.success) {
  // Respond with 403. result.reason says why.
}
// Otherwise continue with result.response, which carries the token cookie and header.

The adapter guide covers the interface and includes a complete Fastify adapter.

Token helpers

import { generateNonce, generateSignedToken, parseSignedToken } from '@csrf-armor/core';

const token = await generateSignedToken(secret, 3600);   // "{expiry}.{nonce}.{signature}"
const { exp } = await parseSignedToken(token, secret);   // throws TokenExpiredError / TokenInvalidError
const nonce = generateNonce(32);                         // 64 hex characters

These only handle cryptography. They don't bind tokens to cookies or sessions; use createCsrfProtection for request protection.

Documentation

• Strategies
• Configuration
• Security guide
• Writing an adapter
• API reference
• Migration

License

MIT © Muneeb Samuels