@csrf-armor/core/dist/constants.d.ts

Framework-agnostic CSRF protection core functionality

import { CsrfConfig } from "./types.js";

//#region src/constants.d.ts

/**
 * HTTP methods that are considered safe and don't require CSRF protection.
 *
 * These methods are defined by RFC 7231 as safe methods that should not have
 * side effects on the server. CSRF attacks typically target state-changing
 * operations, so these methods can safely bypass CSRF validation.
 *
 * @public
 * @example
 * ```typescript
 * import { SAFE_METHODS } from '@csrf-armor/core';
 *
 * if (SAFE_METHODS.includes(request.method)) {
 *   // Skip CSRF validation for safe methods
 *   return next();
 * }
 * ```
 */
declare const SAFE_METHODS: readonly ["GET", "HEAD", "OPTIONS"];
/**
 * Default name for the CSRF token cookie.
 * Used when no custom cookie name is specified in configuration.
 *
 * @internal
 */

/**
 * Default CSRF protection configuration.
 *
 * Provides a complete, secure configuration suitable for production use:
 * - Uses `signed-double-submit` strategy for maximum security
 * - 1-hour token expiry with automatic reissue at 500 seconds
 * - Standard header and field names for broad compatibility
 * - Secure cookie defaults
 *
 * **Security Note**: The default secret is randomly generated and will be
 * different on each application restart. For production, always provide
 * a consistent secret key.
 *
 * @public
 * @example
 * ```typescript
 * import { DEFAULT_CONFIG } from '@csrf-armor/core';
 *
 * // Use defaults with custom secret
 * const config = {
 *   ...DEFAULT_CONFIG,
 *   secret: process.env.CSRF_SECRET || 'your-secret-key'
 * };
 *
 * // Override specific settings
 * const customConfig = {
 *   ...DEFAULT_CONFIG,
 *   strategy: 'double-submit',
 *   token: {
 *     ...DEFAULT_CONFIG.token,
 *     expiry: 7200 // 2 hours
 *   }
 * };
 * ```
 */
declare const DEFAULT_CONFIG: CsrfConfig;
//# sourceMappingURL=constants.d.ts.map
//#endregion
export { DEFAULT_CONFIG, SAFE_METHODS };
//# sourceMappingURL=constants.d.ts.map