Giraffe.Antiforgery 1.0.0

Giraffe.Antiforgery

提供使用 Microsoft.AspNetCore.Antiforgery 包来生成和验证 CSRF 令牌的支持。

入门教程

open Giraffe.Antiforgery
open Giraffe.GiraffeViewEngine.Antiforgery

// rest of code

let formView (token : AntiforgeryTokenSet) = 
    html [] [
        body [] [
                form [ _method "post" ] [
                        antiforgeryInput token
                        input [ _type "submit"; _value "Submit" ]
                    ]                                
            ]
    ]
	
let csrfHandler (token : AntiforgeryTokenSet) : HttpHandler = 
    fun (next: HttpFunc) (ctx : HttpContext) ->                                
        htmlView (formView token) next ctx

let webApp =
    choose [
        GET >=> choose [
                // using htmlView helper
                route "/token" >=> choose [ 
                        GET  >=> csrfHtmlView formView
                        POST >=> requiresCsrfToken (text "intruder!") >=> text "oh hi there ;)" 
                    ]
                // manual token handler
                route "/token" >=> choose [ 
                    GET  >=> csrfTokenizer csrfHandler
                    POST >=> requiresCsrfToken (text "intruder!") >=> text "oh hi there ;)" 
                ]
                route "/" >=> text "hello" 
            ]
        RequestErrors.NOT_FOUND "Not Found"
    ]

// rest of code

处理程序

csrfTokenizer

使用 Microsoft.AspNetCore.Antiforgery 包生成 CSRF 令牌，并将其传递给提供的处理程序。

csrfTokenizer: (handler : AntiforgeryTokenSet -> HttpHandler) -> (next: HttpFunc) -> (ctx : HttpContext) -> HttpFuncResult

csrfHtmlView

将新生成的 CSRF 令牌注入到 Giraffe.GiraffeViewEngine.XmlNode 中。可认为这是增强版的 htmlView。

csrfHtmlView: (view : AntiforgeryTokenSet -> XmlNode) -> (next: HttpFunc) -> (ctx : HttpContext) -> HttpFuncResult

requiresCsrfToken

检查 CSRF 令牌的存在和有效性，并在失败时调用 invalidTokenHandler。类似于 requiresAuthentication。

requiresCsrfToken: (invalidTokenHandler : HttpHandler) -> (next: HttpFunc) -> (ctx : HttpContext) -> HttpFuncResult

HTML

antiforgeryInput

使用 Giraffe.GiraffeViewEngine 生成隐藏的 CSRF 输入。

antiforgeryInput (token : AntiforgeryTokenSet) -> XmlNode

需要 open Giraffe.GiraffeViewEngine.Antiforgery