# [−][src]Struct actix_web::middleware::csrf::CsrfFilter

    pub struct CsrfFilter { /* fields omitted */ }

A middleware that filters cross-site requests.

To construct a CSRF filter:

1. Call `CsrfFilter::build` to start building.
2. Add allowed origins.
3. Call finish to retrieve the constructed filter.

# Example

    use actix_web::middleware::csrf;
    use actix_web::App;

    let app = App::new()
        .middleware(csrf::CsrfFilter::new().allowed_origin("https://www.example.com"));

## Methods

###

`impl CsrfFilter`

[src]

####

`pub fn new() -> CsrfFilter`

[src]

Start building a `CsrfFilter`.

####

`pub fn allowed_origin<T: Into<String>>(self, origin: T) -> CsrfFilter`

[src]

Add an origin that is allowed to make requests. Will be verified against the `Origin` request header.

####

`pub fn allow_xhr(self) -> CsrfFilter`

[src]

Allow all requests with an `X-Requested-With` header.

A cross-site attacker should not be able to send requests with custom headers unless a CORS policy whitelists them. Therefore it should be safe to allow requests with an `X-Requested-With` header (added automatically by many JavaScript libraries).

This is disabled by default, because in Safari it is possible to circumvent this using redirects and Flash.

Use this method to enable more lax filtering.

####

`pub fn allow_missing_origin(self) -> CsrfFilter`

[src]

Allow requests if the expected `Origin` header is missing (and there is no `Referer` to fall back on).

The filter is conservative by default, but it should be safe to allow missing `Origin` headers because a cross-site attacker cannot prevent the browser from sending `Origin` on unprotected requests.

####

`pub fn allow_upgrade(self) -> CsrfFilter`

[src]

Allow cross-site upgrade requests (for example to open a WebSocket).

## Trait Implementations

###

`impl<S> Middleware<S> for CsrfFilter`

[src]

####

`fn start(&self, req: &HttpRequest<S>) -> Result<Started>`

[src]

Method is called when request is ready. It may return future, which should resolve before next middleware get called. Read more

####

`fn response(&self, req: &HttpRequest<S>, resp: HttpResponse) -> Result<Response>`

[src]

Method is called when handler returns response, but before sending http message to peer. Read more

####

`fn finish(&self, req: &HttpRequest<S>, resp: &HttpResponse) -> Finished`

[src]

Method is called after body stream get sent to peer.

###

`impl Default for CsrfFilter`

[src]

####

`fn default() -> CsrfFilter`

[src]

Returns the "default value" for a type. Read more

## Auto Trait Implementations

###

`impl Send for CsrfFilter`

###

`impl Sync for CsrfFilter`

## Blanket Implementations

###

`impl<T> From for T`

[src]

####

`fn from(t: T) -> T`

[src]

Performs the conversion.

###

`impl<T, U> Into for T where U: From<T>,`

[src]

####

`fn into(self) -> U`

[src]

Performs the conversion.

###

`impl<T, U> TryFrom for T where T: From<U>,`

[src]

#### `type Error = !`

🔬 This is a nightly-only experimental API. (`try_from`)

The type returned in the event of a conversion error.

####

`fn try_from(value: U) -> Result<T, <T as TryFrom<U>>::Error>`

[src]

🔬 This is a nightly-only experimental API. (`try_from`)

Performs the conversion.

###

`impl<T> Borrow for T where T: ?Sized,`

[src]

####

`fn borrow(&self) -> &T`

[src]

Immutably borrows from an owned value. Read more

###

`impl<T> BorrowMut for T where T: ?Sized,`

[src]

####

`fn borrow_mut(&mut self) -> &mut T`

[src]

Mutably borrows from an owned value. Read more

###

`impl<T, U> TryInto for T where U: TryFrom<T>,`

[src]

#### `type Error = <U as TryFrom<T>>::Error`

🔬 This is a nightly-only experimental API. (`try_from`)

The type returned in the event of a conversion error.

####

`fn try_into(self) -> Result<U, <U as TryFrom<T>>::Error>`

[src]

🔬 This is a nightly-only experimental API. (`try_from`)

Performs the conversion.

###

`impl<T> Any for T where T: 'static + ?Sized,`

[src]

####

`fn get_type_id(&self) -> TypeId`

[src]

🔬 This is a nightly-only experimental API. (`get_type_id`)

this method will likely be replaced by an associated static

Gets the `TypeId` of `self`. Read more

###

`impl<T> Erased for T`

# Help

## Keyboard Shortcuts

`?`
  Show this help dialog
`S`
  Focus the search field
`↑`
  Move up in search results
`↓`
  Move down in search results
`↹`
  Switch tab
`⏎`
  Go to active search result
`+`
  Expand all sections
`-`
  Collapse all sections

## Search Tricks

Prefix searches with a type followed by a colon (e.g. `fn:`) to restrict the search to a given type.

Accepted types are: `fn`, `mod`, `struct`, `enum`, `trait`, `type`, `macro`, and `const`.

Search functions by type signature (e.g. `vec -> usize` or `* -> vec`)

Search multiple things at once by splitting your query with comma (e.g. `str,u8` or `String,struct:Vec,test`)