CSRF Protection

Usage#

import { csrf } from '@axiljs/security'
app.use(csrf())

How it works#

1. Server sets a random token as a cookie
2. Client sends the token as x-csrf-token header
3. Server compares using constant-time comparison

Safe methods (GET, HEAD, OPTIONS) skip validation.