File Coverage

blib/lib/Mojolicious/Plugin/WithCSRFProtection.pm

Criterion	Covered	Total	%
statement	22	23	95.6
branch	6	8	75.0
condition	6	6	100.0
subroutine	5	5	100.0
pod	1	1	100.0
total	40	43	93.0

package Mojolicious::Plugin::WithCSRFProtection;

# ABSTRACT: Mojolicious plugin providing CSRF protection at the routing level

use Mojo::Base 'Mojolicious::Plugin';

our $VERSION = '1.02';

sub register {
    my ( $self, $app ) = @_;

    my $routes = $app->routes;

    $app->helper(
        'reply.bad_csrf' => sub {
            my ($c) = @_;
            $c->res->code(403);
            $c->render_maybe('bad_csrf')
                or $c->render( text => 'Failed CSRF check' );
            return;
        }
    );

    $routes->add_condition(
        with_csrf_protection => sub {
            my ( $route, $c ) = @_;

            my $csrf = $c->req->headers->header('X-CSRF-Token')
                || $c->param('csrf_token');

            unless ( $csrf && $csrf eq $c->csrf_token ) {
                $c->reply->bad_csrf unless $c->stash->{'mojo.finished'};
                return;
            }

            return 1;
        }
    );

    $routes->add_shortcut(
        with_csrf_protection => sub {
            my ($route) = @_;
            if ($Mojolicious::VERSION >= 9) {
                return $route->requires( with_csrf_protection => 1 );
            } else {
                return $route->over( with_csrf_protection => 1 );
            }
        }
    );

    return;
}

1;

__END__