Skip to content

CSRF protection implementation in Oxpecker - #83

Merged
Lanayx merged 9 commits into
v2from
CSRF
Nov 2, 2025
Merged

CSRF protection implementation in Oxpecker#83
Lanayx merged 9 commits into
v2from
CSRF

Conversation

@Lanayx

@Lanayx Lanayx commented Oct 31, 2025

Copy link
Copy Markdown
Owner
  • Enabled by default for POST, PUT, PATCH requests if Antiforgery is also enabled (similar to MiminalApi)
  • AntiforgeryValidationException is thrown on .BindForm (similar to MinimalApi's implementation)
  • User can disable it using .DisableAntiforgery on endpoint
  • User can add custom middleware to fail earlier if needed
  • User can add CSRF on GET manually by using _.WithMetadata(RequireAntiforgeryTokenAttribute()) on endpoint
  • User should use ctx.GetAntiforgeryInput() to add hidden antiforgery input to the form.

Now as there are three different exceptions that Oxpecker throws, I've added default error and not found handlers to use:

app.UseRouting()
    .Use(DefaultHandlers.errorHandler)
    .UseOxpecker(endpoints)
    .Run(DefaultHandlers.notFoundHandler)

@Thorium Thorium left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@Lanayx
Lanayx changed the base branch from develop to v2 November 1, 2025 16:29
@Lanayx
Lanayx marked this pull request as ready for review November 1, 2025 16:30
@Lanayx
Lanayx merged commit 725dcea into v2 Nov 2, 2025
4 checks passed
@Lanayx
Lanayx deleted the CSRF branch April 24, 2026 01:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants