Config for CSRF

[g105b]

The CSRF check blocks client-side POSTs. Maybe this is a good thing, maybe not. The point is that it is currently blocking me from uploading a file using the browser's fetch api.

[g105b]

I've just hit this issue again. It's sometimes useful to specify that CSRF is not a concern on certain URIs. It makes complete sense to block POSTs by default without a valid token, because this removes a lot of attack vectors, but certain URIs are simply required to be used with a single, naked POST request, without having to request a valid token first.

[g105b]

Another thing to configure is whether or not to use a shared token across all forms vs. or one token per form.

And the length of the token...

I'll add to this issue with other configuration requirements to deal with.

[g105b]

• Non-protected URIs with wildcards
• Token length
• One token per Form/Page