Repository navigation
CSRF middleware for actix-web 1.0 #1185
Description
Activity
It wasn’t ported.
Reacted by Tomas Miklovic and CobaltIs there any chance of https://github.com/SnoozeTime/actix-csrf getting some more support?
@tommket what do you mean with support ? You can ask the author https://github.com/SnoozeTime if you're missing any features.
@0xpr03 I mean if it could become one of the other actix-... crates the same way the other middleware crates got created and continually maintained?
There is an open issue SnoozeTime/actix-csrf#1 where the author recently stated that he is waiting for someone sufficiently knowledgeable in actix and rust to review his code, before he is willing to release it as a crate. So pls anyone contributing to actix-... code and willing to review it would be welcome.Just as a note: I'm using the SameSite attribute as CSRF prevention.
i guess there is nothing to do in actix-web repo
Reacted by Proc, deprecated and CobaltDoes anyone know why it was removed?
If somebody is looking for CSRF implementation for Actix web that supports synchronizer token (statefull) and double-submit cookie (stateless powered by HMACs) patterns, check this crate: https://github.com/yoozzeek/actix-csrf-middleware
Not audited, may contain bugs/security issues. If some Rust/Actix/Sec pros could make 10min review and a GH issue that would help a lot. I fix fast and want to stabilize the crate.
Maybe one day it lands in actix-web core, but it uses actix-session (optional feature) for synchronizer-token logic; so it's probably not suitable PR for core.
Reacted by Rob Ede- locked and limited conversation to collaborators
on Oct 11, 2025 - unlocked this conversation
on Oct 11, 2025 - locked and limited conversation to collaborators
on Oct 11, 2025
Where is the CSRF middleware for actix-web 1.0?