File Coverage

blib/lib/Dancer2/Plugin/CSRF.pm

Criterion	Covered	Total	%
statement	17	33	51.5
branch	0	2	0.0
condition	0	2	0.0
subroutine	6	8	75.0
pod	2	2	100.0
total	25	47	53.1

package Dancer2::Plugin::CSRF;
use 5.006;
use strict;
use warnings;

our $VERSION = '1.0';

use Dancer2::Plugin;
use Crypt::SaltedHash;
use Data::UUID;

my $HASHER = Crypt::SaltedHash->new( algorithm => 'SHA-1' );
my $UUID = Data::UUID->new();

has session_key_name => (
	is      => 'ro',
	default => sub {
		$_[0]->config->{session_key_name} || 'plugin.csrf';
	}
);

plugin_keywords qw( get_csrf_token validate_csrf_token );

sub get_csrf_token {
	my ($self) = @_;
	my $config = $self->dsl->session( $self->session_key_name() );
	unless ($config) {
		$config = { token => $UUID->create_str(), };
		$self->dsl->session( $self->session_key_name() => $config );
	}

	( my $path = $self->dsl->request->dispatch_path ) =~ s{^/}{};
	my $form_url = $self->dsl->request->base . $path;
	my $token = $HASHER->add( $config->{token}, $form_url )->generate();
	$HASHER->clear();
	return $token;
}

sub validate_csrf_token {
	my ( $self, $got_token ) = @_;
	my $form_url = $self->dsl->request->header('referer');
	my $config = $self->dsl->session( $self->session_key_name() ) // return;
	my $expected_token
		= $HASHER->add( $config->{token}, $form_url )->generate();
	$HASHER->clear();
	return $expected_token eq $got_token;
}

1;

__END__