🛡️ Sepal

v5.0 - 13 Aug 2026

Added

• CSRF now works with zero configuration: the secret resolves in order from a secret passed to csrf(), then X_CSRF_SECRET in your .env, then a secret derived automatically from your APP_KEY. Any project with an APP_KEY is covered without touching anything
• If no secret can be resolved at all, Leaf throws a clear exception at startup instead of running CSRF protection without one
• Added opt-in single-use tokens with rotate, and regenerate() for manual rotation on events like login
• SPAs need no manual plumbing: an XSRF-TOKEN cookie is set automatically and the X-XSRF-TOKEN header is accepted back, matching the axios convention out of the box
• Tokens are also accepted via the X-CSRF-TOKEN header for classic AJAX
• Excepted paths support both literal paths and dynamic patterns
• Added a full test suite covering the whole verify flow, run through Alchemy

Changed

• Tokens use a new format. Tokens minted before the upgrade won't validate on v5, so a session holding one needs a single page refresh — nothing to configure
• The derived secret is mixed with a fixed context string, so it is never your raw APP_KEY, and rotating your APP_KEY invalidates in-flight tokens (a page refresh mints new ones)
• Malformed token input, like an array where a string belongs, fails verification cleanly
• CSRF now requires PHP 8.2+