Module csrf 

CSRF protection plugin (csrf).

Port of APISIX’s csrf plugin using the double-submit-cookie pattern: safe methods (GET/HEAD/OPTIONS) pass through and receive a signed token cookie; unsafe methods must send the same token in both the cookie and a request header, with a valid HMAC signature and unexpired timestamp. Failures are routed through the error port as 401 with code CSRF_INVALID.

Token layout mirrors APISIX (base64(json{random, expires, sign})) but the signature is hex(HMAC-SHA256(key, random || expires)) via ring instead of APISIX’s plain SHA-256 over a Lua-formatted string, so featherbit tokens only round-trip against featherbit — they are not APISIX-compatible.

APISIX sets the cookie in its header_filter phase (after the upstream response). featherbit’s upstream node replaces context.response.headers wholesale, so a cookie set before proxying would be lost. The phase option maps APISIX’s two phases onto the node graph: place a phase: request node before the upstream (validation) and a phase: response node after it (cookie issuance) sharing the same key.

Structs

CsrfPlugin

Double-submit-cookie CSRF protection keyed by an HMAC secret.

Enums

CsrfPhase 🔒

Which APISIX phase this node instance emulates.

Constants

SAFE_METHODS 🔒

Functions

hex_decode 🔒

Decodes a lowercase/uppercase hex string; None on invalid input.

hex_encode 🔒

Hex-encodes a byte slice (lowercase).

now 🔒

Current unix timestamp in seconds.