refactor(server): rename CSRFGuardHandlerPlugin to SimpleCsrfProtectionHandlerPlugin

[dinwwwh]

Renames CSRFGuardHandlerPlugin to SimpleCsrfProtectionHandlerPlugin. The old name overpromised: the plugin only blocks HTML-initiated requests (navigations, form submissions, embeds) via Sec-Fetch-Mode, a first line of defense rather than complete CSRF protection. "Simple" makes that partial scope explicit.

Changes

• Class, internal plugin name (~simple-csrf-protection), and source/test filenames renamed; no deprecated alias since the old name was never released.
• Docs page moved to /docs/plugins/simple-csrf-protection; intro now says "first line of defense" instead of claiming full protection. Sidebar and RPC handler doc references updated.

Testing

• Plugin and export tests pass; pnpm type:check clean; no references to the old name remain.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
orpc	Ready	Preview	Aug 4, 2026 8:43am

[pkg-pr-new]

More templates

• @orpc/bun-playground
• @orpc/cloudflare-playground
• @orpc/nest-playground
• @orpc/next-playground

@orpc/ai-sdk

npm i https://pkg.pr.new/@orpc/ai-sdk@1780

@orpc/arktype

npm i https://pkg.pr.new/@orpc/arktype@1780

@orpc/bun

npm i https://pkg.pr.new/@orpc/bun@1780

@orpc/client

npm i https://pkg.pr.new/@orpc/client@1780

@orpc/cloudflare

npm i https://pkg.pr.new/@orpc/cloudflare@1780

@orpc/contract

npm i https://pkg.pr.new/@orpc/contract@1780

@orpc/experimental-effect

npm i https://pkg.pr.new/@orpc/experimental-effect@1780

@orpc/evlog

npm i https://pkg.pr.new/@orpc/evlog@1780

@orpc/hibernation

npm i https://pkg.pr.new/@orpc/hibernation@1780

@orpc/json-schema

npm i https://pkg.pr.new/@orpc/json-schema@1780

@orpc/nest

npm i https://pkg.pr.new/@orpc/nest@1780

@orpc/next

npm i https://pkg.pr.new/@orpc/next@1780

@orpc/openapi

npm i https://pkg.pr.new/@orpc/openapi@1780

@orpc/opentelemetry

npm i https://pkg.pr.new/@orpc/opentelemetry@1780

@orpc/pinia-colada

npm i https://pkg.pr.new/@orpc/pinia-colada@1780

@orpc/pino

npm i https://pkg.pr.new/@orpc/pino@1780

@orpc/publisher

npm i https://pkg.pr.new/@orpc/publisher@1780

@orpc/ratelimit

npm i https://pkg.pr.new/@orpc/ratelimit@1780

@orpc/server

npm i https://pkg.pr.new/@orpc/server@1780

@orpc/shared

npm i https://pkg.pr.new/@orpc/shared@1780

@orpc/swr

npm i https://pkg.pr.new/@orpc/swr@1780

@orpc/tanstack-query

npm i https://pkg.pr.new/@orpc/tanstack-query@1780

@orpc/trpc

npm i https://pkg.pr.new/@orpc/trpc@1780

@orpc/valibot

npm i https://pkg.pr.new/@orpc/valibot@1780

@orpc/zod

npm i https://pkg.pr.new/@orpc/zod@1780

commit: 0943e62

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[pullfrog]

Important

The old name was already published, so the "never released" justification for dropping it without a deprecated alias is inaccurate — please confirm a hard-breaking rename is intended.

Reviewed changes — This run reviewed the full diff of 7 files: a rename of the server plugin CSRFGuardHandlerPlugin → SimpleCsrfProtectionHandlerPlugin, its internal name ~csrf-guard → ~simple-csrf-protection, the source/test file renames under packages/server/src/plugins/, and the docs page move to /docs/plugins/simple-csrf-protection with warning copy + sidebar and RPC handler reference updates.

• Rename the plugin class, internal plugin name, and export in packages/server/src/plugins/
• Rename source/test files and update the plugin export + export test
• Move the docs page and update all references, link, and JSDoc @see

⚠️ Deprecated-alias decision rests on a wrong premise

The PR body says no deprecated alias is kept "since the old name was never released." Git history contradicts that: csrf-guard.ts was added in #1763 (db548c81) and the export was live in the tree when chore: release v2.0.0-beta.24 (5965f879) was cut on 2026-08-03 — so CSRFGuardHandlerPlugin was shipped in the published @orpc/server@2.0.0-beta.24. Removing the export outright (rather than keeping a deprecated alias) will hard-break any downstream consumer on that beta who imported it.

Since this is a pre-release 2.0.0-beta line, a hard break may well be acceptable — but the stated reason is factually wrong, and the surviving consequence (a compile/import break for beta consumers on upgrade) should be a conscious choice rather than an accidental one. Recommend either keeping a lightweight deprecated alias, or explicitly acknowledging in the PR body that 2.0.0-beta.24 consumers will break and that this is intended.

The mechanical rename itself is complete and clean: grep finds no remaining CSRFGuard / csrf-guard references anywhere in the tree, and all five simple-csrf references are consistent.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using DeepSeek Flash (free via Pullfrog for OSS) ｜ 𝕏}

[codspeed-hq]

Merging this PR will not alter performance

✅ 25 untouched benchmarks

---

_{Comparing dinwwwh:claude/csrf-guard-handler-naming-c32d06 (0943e62) with main (5995211)}