csrf_valid
lib callCapy
function csrf_valid(submitted : string, session_name : string = "bearer-session", token_name : string = "csrf_token", request : capture any) bool
Description
csrf_valid() checks a submitted CSRF token against the session token.
It does not create a missing token. It starts the named session if needed, which can create a session cookie. Empty tokens fail.
The comparison uses crypto_equal(). A successful check does not consume the token. Call csrf_rotate() when you need to invalidate it.
Pass the submitted field explicitly, for example string(request.form.csrf_token). This function does not read the form or reject the request for you. If it returns false, do not apply the change.
Parameters
request : the caller's request, captured when omitted
submitted : the value from the submitted form
session_name : the session and cookie name
token_name : the token namespace
Return Values
true if submitted matches the active session token.
Example
Capy
var token := csrf_token("capy-doc-session")
print(csrf_valid(token, "capy-doc-session"), "\n")
Output
true