@csrf-armor/core/dist/constants.mjs.map

Framework-agnostic CSRF protection core functionality

{"version":3,"file":"constants.mjs","names":[],"sources":["../src/constants.ts"],"sourcesContent":["import { generateSecureSecret } from './crypto.js';\nimport type { CookieOptions, CsrfConfig } from './types.js';\n\n/**\n * HTTP methods that are considered safe and don't require CSRF protection.\n *\n * These methods are defined by RFC 7231 as safe methods that should not have\n * side effects on the server. CSRF attacks typically target state-changing\n * operations, so these methods can safely bypass CSRF validation.\n *\n * @public\n * @example\n * ```typescript\n * import { SAFE_METHODS } from '@csrf-armor/core';\n *\n * if (SAFE_METHODS.includes(request.method)) {\n *   // Skip CSRF validation for safe methods\n *   return next();\n * }\n * ```\n */\nexport const SAFE_METHODS = ['GET', 'HEAD', 'OPTIONS'] as const;\n\n/**\n * Default name for the CSRF token cookie.\n * Used when no custom cookie name is specified in configuration.\n *\n * @internal\n */\nexport const DEFAULT_CSRF_COOKIE_NAME = 'csrf-token';\n\n/**\n * Suffix appended to server-side CSRF cookies for signed strategies.\n * Server cookies contain the signature or validation data.\n *\n * @internal\n */\nexport const SERVER_CSRF_COOKIE_SUFFIX = '-server';\n\n/**\n * Default HTTP header name for CSRF tokens.\n * Commonly used in AJAX requests and API calls.\n *\n * @internal\n */\nexport const CSRF_TOKEN_HEADER = 'x-csrf-token';\n\n/**\n * HTTP header name used to communicate the CSRF strategy to clients.\n * Helps debugging and allows clients to adapt their token handling.\n *\n * @internal\n */\nexport const CSRF_STRATEGY_HEADER = 'x-csrf-strategy';\n\n/**\n * Default length for cryptographic nonces in most CSRF strategies.\n * Provides 256 bits of entropy for strong security.\n *\n * @internal\n */\nexport const DEFAULT_NONCE_LENGTH = 32;\n\n/**\n * Shorter nonce length used specifically for origin-check strategy.\n * Since origin-check relies primarily on origin validation, a smaller\n * nonce is sufficient for preventing replay attacks.\n *\n * @internal\n */\nexport const ORIGIN_CHECK_NONCE_LENGTH = 16;\n\n/**\n * Default cookie configuration for CSRF tokens.\n *\n * Provides secure defaults suitable for most web applications:\n * - `secure: true` - Requires HTTPS (should be overridden for development)\n * - `httpOnly: false` - Allows JavaScript access for SPA token retrieval\n * - `sameSite: 'lax'` - Provides CSRF protection while allowing normal navigation\n * - `path: '/'` - Makes cookie available across the entire application\n *\n * @public\n * @example\n * ```typescript\n * import { DEFAULT_COOKIE_OPTIONS } from '@csrf-armor/core';\n *\n * const customConfig = {\n *   ...DEFAULT_COOKIE_OPTIONS,\n *   secure: false, // For development\n *   domain: '.example.com' // For subdomain sharing\n * };\n * ```\n */\nexport const DEFAULT_COOKIE_OPTIONS: CookieOptions = {\n  name: 'csrf-token',\n  secure: true,\n  httpOnly: false,\n  sameSite: 'lax',\n  path: '/',\n} as const;\n\n/**\n * Default CSRF protection configuration.\n *\n * Provides a complete, secure configuration suitable for production use:\n * - Uses `signed-double-submit` strategy for maximum security\n * - 1-hour token expiry with automatic reissue at 500 seconds\n * - Standard header and field names for broad compatibility\n * - Secure cookie defaults\n *\n * **Security Note**: The default secret is randomly generated and will be\n * different on each application restart. For production, always provide\n * a consistent secret key.\n *\n * @public\n * @example\n * ```typescript\n * import { DEFAULT_CONFIG } from '@csrf-armor/core';\n *\n * // Use defaults with custom secret\n * const config = {\n *   ...DEFAULT_CONFIG,\n *   secret: process.env.CSRF_SECRET || 'your-secret-key'\n * };\n *\n * // Override specific settings\n * const customConfig = {\n *   ...DEFAULT_CONFIG,\n *   strategy: 'double-submit',\n *   token: {\n *     ...DEFAULT_CONFIG.token,\n *     expiry: 7200 // 2 hours\n *   }\n * };\n * ```\n */\nexport const DEFAULT_CONFIG: CsrfConfig = {\n  strategy: 'signed-double-submit',\n  token: {\n    expiry: 3600,\n    headerName: 'X-CSRF-Token',\n    fieldName: 'csrf_token',\n    reissueThreshold: 500,\n  },\n  cookie: DEFAULT_COOKIE_OPTIONS,\n  secret: generateSecureSecret(),\n  allowedOrigins: [],\n  excludePaths: [],\n  skipContentTypes: [],\n} as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,eAAe;CAAC;CAAO;CAAQ;CAAU;;;;;;;AAgBtD,MAAa,4BAA4B;;;;;;;AAQzC,MAAa,oBAAoB;;;;;;;AAQjC,MAAa,uBAAuB;;;;;;;AAQpC,MAAa,uBAAuB;;;;;;;;AASpC,MAAa,4BAA4B;;;;;;;;;;;;;;;;;;;;;;AAuBzC,MAAa,yBAAwC;CACnD,MAAM;CACN,QAAQ;CACR,UAAU;CACV,UAAU;CACV,MAAM;CACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCD,MAAa,iBAA6B;CACxC,UAAU;CACV,OAAO;EACL,QAAQ;EACR,YAAY;EACZ,WAAW;EACX,kBAAkB;EACnB;CACD,QAAQ;CACR,QAAQ,sBAAsB;CAC9B,gBAAgB,EAAE;CAClB,cAAc,EAAE;CAChB,kBAAkB,EAAE;CACrB"}