Module csrf 

The page half of CSRF: a page document carries its visitor’s token in its head, where the browser host reads it and sends it back as x-csrf-token on the page’s state-changing requests to its own server. One definition for every tier that composes or reads a page — the dev server, a compiled server, the in-process host and the browser runtime’s shared name.

Constants

CSRF_META_NAME

The <meta name> a page document carries its visitor’s CSRF token under.

Functions

with_csrf_meta

document carrying token in its head as <meta name="csrf-token">. The meta opens the head, so a page’s own Head: merges over it by identity like every other head element. A document with no <head> is returned as it is.