29 lines
1.1 KiB
TypeScript
29 lines
1.1 KiB
TypeScript
import type { OpenApiSecurityScheme } from "../security-scheme/security-scheme.js";
|
|
|
|
/**
|
|
* Default CSRF policy keyed off an `OpenApiSecurityScheme`.
|
|
*
|
|
* Per design doc §6: "Cookie-based auth adapters trigger CSRF verification."
|
|
* The default is ON for any scheme that ambient-authority sends with the
|
|
* request (cookies); OFF for any scheme that requires the caller to actively
|
|
* attach the credential to the request (bearer tokens, OAuth2 access tokens,
|
|
* OIDC).
|
|
*
|
|
* The host applies per-route overrides on top of this default. This module
|
|
* exposes only the policy default; the host owns the override path.
|
|
*/
|
|
export const CsrfPolicy = Object.freeze({
|
|
/**
|
|
* Returns `true` when requests authenticated via the supplied scheme MUST
|
|
* carry a CSRF token (double-submit, header-pin, or origin check — the
|
|
* host picks the mechanism). Returns `false` when CSRF verification is
|
|
* not required by default.
|
|
*/
|
|
requiresCsrf(scheme: OpenApiSecurityScheme): boolean {
|
|
if (scheme.type === "apiKey" && scheme.in === "cookie") {
|
|
return true;
|
|
}
|
|
return false;
|
|
},
|
|
});
|