First-party CSRF story for forms and API routes

[JoviDeCroock]

Problem

Pracht provides primitives that make cookie-backed mutations easy:

• <Form method=post action=...>
• API routes with POST, PUT, PATCH, and DELETE
• middleware-driven session auth

But there is no built-in CSRF defense story in the framework itself. If an app
uses ambient cookies for auth, cross-site form posts or fetches can become the
app developer's problem by default.

Consider

Define a first-party CSRF posture for state-changing requests:

• document the minimum safe baseline for cookie-backed auth
• provide helpers for token generation and verification, or a middleware pattern
• support origin / same-site validation where appropriate
• clarify how this should work across Node, Cloudflare, and Vercel adapters
• make examples and starter templates follow the recommended pattern

Why it matters

This is a common web security footgun. If the framework makes mutations easy, it
should also make the safe path obvious and easy to adopt.

[barelyhuman]

Before we do this, I'd also like to know if we wish to have it in a way where the user decides when to use the CSRF token or do we want all post requests to always have a CSRF token.

For the latter, the header based csrf can be added and verified by the framework and since it's only on the request, adapter support becomes automatic. If we wish to allow the user to specifically define if CSRF needs to be verified for a certain request then the ergonomics need to work well with the roundtrip.

Ex: the loader needs to let the server know that a CSRF is being used by this route and a POST on the same will require verification. The value store for this will need better thought, I can check if other frameworks do this in a certain manner.

The automatic is definitely more convenient but also has edge cases where loss of CSRF in certain redirects might error out

---

The implementation itself can be picked up from https://github.com/pillarjs/csrf, the cross platform handling can be done using https://github.com/unjs/uncrypto for the hashing and hash compares