CSRF plugin for Mojolicious using built-in csrf_field / csrf_protect — thoughts welcome

[brianread108]

Hi everyone,

I and my LLM helper have put together a small Mojolicious plugin that modernizes an older CSRF helper approach by switching it over to Mojolicious’s built-in CSRF support.

Repository: Mojolicious-Plugin-CSRFProtectBuiltin

The idea is:

Automatically wrap form_for so block-style forms get a CSRF hidden field inserted.

Use Mojolicious built-in csrf_token, csrf_field, and csrf_protect.

Keep a small compatibility layer for apps that already expect helpers like csrftoken and is_valid_csrftoken.

Optionally provide a jQuery AJAX helper that sends the token in the X-CSRF-Token header.

The motivation is mostly practical: I have a Mojolicious app with a lot of existing form_for usage, and I wanted a low-friction way to add CSRF protection without editing every form by hand.

I’d really appreciate any thoughts on a few things:

Does this seem useful as a standalone plugin?

Is wrapping form_for the right approach, or would you prefer a different pattern?

Should the plugin stay minimal and only cover forms, or also include the AJAX helper?

Would this be better as a CPAN distribution, a recipe in the docs, or a small community-maintained helper?

If there’s interest, I can continue polishing it, add some tests, and publish it properly.

Thanks for any feedback

[guest20]

Looks like it could use some unit tests ...