Simple CSRF Protection Plugin

Use SimpleCsrfProtectionHandlerPlugin to add a first line of defense against Cross-Site Request Forgery (CSRF) attacks by rejecting requests with unsafe fetch modes.

How It Works

The plugin inspects the Sec-Fetch-Mode header and blocks requests with a mode of navigate, no-cors, or websocket, which may be triggered by cross-site links, forms, or other passive browser features.

Setup

import { OpenAPIHandler } from '@orpc/openapi/fetch'
import { SimpleCsrfProtectionHandlerPlugin } from '@orpc/server/plugins'

const handler = new OpenAPIHandler(router, {
  plugins: [
    new SimpleCsrfProtectionHandlerPlugin(),
  ],
})

INFO

The handler can be any supported oRPC handler, such as RPCHandler, OpenAPIHandler, or a custom one.

Learn More

For implementation details, see the source code.