NAME

Pickles::Plugin::AntiCSRF - CSRF Block Plugin

SYNOPSIS

package MyApp::Context;
use parent qw(Pickles::Context);

__PACKAGE__->load_plugins(qw(Encode AntiCSRF));

## etc/config.pl
return +{
    'Plugin::AntiCSRF' => {
        token_name => '_token',
        token_length => 8
    }
};

# etc/routes.pl
router {
    # no CSRF protection
    connect '/' => { controller => 'Root', action => 'index' };
    
    # Automatically protected!
    connect '/commit' =>
      { controller => 'Root', action => 'commit' },
      { method => 'POST' };
};

DESCRIPTION

Provides basic CSRF detection/protection.

CONTROLLING CSRF CHECK

USING THE STASH

## lib/MyApp/Context.pm

__PACKAGE__->load_plugins(qw(Encode AntiCSRF));

__PACKAGE__->add_trigger( init => sub {
    my( $c ) = @_;
    if ($c->req->path=~m|^/api|) {
        $c->stash->{skip_csrf_check}++;
    }
} );

USING ROUTES

connect '/api' =>
    {
        controller => 'Root',
        action => 'api',
        skip_csrf_check => 1 # Disable CSRF check
    },
    {
        method => 'POST'
    }
;