/Wiki/sources/honojs__hono/2026/https-hono-dev-llms-full-txt-csrf-protection-8059bdd2b085-csrf-protection-s0140-c0000.md
CSRF Protection - hono-docs
CSRF Protection Source evidence: /Sources/raw/honojs hono/honojs hono.md Canonical citation: https://hono.dev/llms full.txt csrf protection Summary This midd...
CSRF Protection
Source evidence: /Sources/raw/honojshono/honojshono.md Canonical citation: https://hono.dev/llms-full.txt#csrf-protection
Summary
This middleware protects against CSRF attacks by checking both the Origin header and the Sec-Fetch-Site header. The request is allowed if either validation passes. The middleware only validates requests that: - Use unsafe HTTP method...
Content
This middleware protects against CSRF attacks by checking both the Origin header and the Sec-Fetch-Site header. The request is allowed if either validation passes.
The middleware only validates requests that:
- Use unsafe HTTP methods (not GET, HEAD, or OPTIONS)
- Have content types that can be sent by HTML forms (
application/x-www-form-urlencoded,multipart/form-data, ortext/plain)
Old browsers that do not send Origin headers, or environments that use reverse proxies to remove these headers, may not work well. In such environments, use other CSRF token methods.
Kinic Wiki