fast-twitch.middlewares.anti-forgery

Usage and execution boundary

Validates submitted tokens on unsafe methods and binds token/parameter-name delays for rendering. Session and form parsing must run first. GET rendering supplies the token for the next form submission. The default failure response is 403.

(ns application.middleware
  (:require [fast-twitch.middlewares.anti-forgery :as middleware]))

(defn handler [_]
  {:status 200 :headers {"content-type" "text/plain"} :body "Hello"})

(def app (middleware/wrap-anti-forgery handler))

This defines the Ring handler portion. Adapt app through routing/ft-handler or pass it to server/listen!; startup instructions and a complete walkthrough show the surrounding project.

Settings and defaults

Wrapper order and all middleware families. The function reference below preserves the upstream signatures and source links; helper functions do not all share the wrapper's arity.

Render and submit the same token

The wrapper puts anti-forgery-token on the request and persists it through session response data. The hidden field helper reads request-scoped bindings, which are delays; it returns Hiccup to render inside a form. The submitted field/header must match the stored token on a protected method. A missing/incorrect token produces 403 unless configured otherwise.

Trusted safe-header presence and explicit exemptions bypass comparison; they are not proof that a header contains the correct token. Configure them only as part of the application's intended trust boundary. Site defaults explicitly choose X-Ft-Anti-Forgery as a safe header.

For asynchronous views, capture request values before awaiting or use bound-anti-forgery-fn to capture current bindings. The renderer must still capture values itself if it awaits internally. Explicit response session nil clears it rather than restoring a token. Bound renderer example · Hidden field helper.

Upstream function reference

Adds request token validation and token persistence for unsafe form submissions.

*anti-forgery-param-name*

The anti-forgery form parameter name bound while rendering a protected request. Source

*anti-forgery-token*

The anti-forgery token bound while rendering a protected request. Source

bound-anti-forgery-fn

(bound-anti-forgery-fn f)

Function.

Captures the current anti-forgery binding and restores it while f runs. Source

default-error-response

The default response returned when anti-forgery validation fails. Source

default-exempt-prefixes

The default URI prefixes exempted from anti-forgery checks. Source

default-header-names

The default request headers checked for submitted anti-forgery tokens. Source

default-token-param-name

The default form parameter name for submitted anti-forgery tokens. Source

request-token

(request-token request)
(request-token request options)

Function.

Reads a submitted anti-forgery token from params or request headers. Source

token-param-name

(token-param-name options)

Function.

Returns the configured token parameter name, falling back to the default. Source

unsafe-methods

HTTP methods that require anti-forgery validation by default. Source

wrap-anti-forgery

(wrap-anti-forgery handler)
(wrap-anti-forgery handler options)

Function.

Wraps a handler with anti-forgery token validation and session token storage. Source