AdminCsrf class

Cryptographic CSRF token manager for bloom_admin.

Implements HMAC-SHA256 based CSRF tokens bound to a server secret or session. Guarantees that state-changing admin actions (POST, PUT, DELETE) originate from authenticated and legitimate admin form submissions.

Constructors

AdminCsrf({String? secret})
Creates an AdminCsrf instance with an optional HMAC signing _secret.

Properties

hashCode → int
The hash code for this object.
no setterinherited
runtimeType → Type
A representation of the runtime type of the object.
no setterinherited

Methods

extractToken(BloomRequest request, [Map<String, String>? formData]) → String?
Extracts the CSRF token from a BloomRequest, checking form data, headers, or query params.
generateToken([String identifier = 'session']) → String
Generates a signed, opaque CSRF token for a given session / nonce identifier.
noSuchMethod(Invocation invocation) → dynamic
Invoked when a nonexistent method or property is accessed.
inherited
toString() → String
A string representation of this object.
inherited
validateRequest(BloomRequest request, [Map<String, String>? formData]) → bool
Validates a request against CSRF attacks. Returns true if valid.
verifyToken(String? token, [String identifier = 'session']) → bool
Verifies that a submitted CSRF token is cryptographically valid and authentic.

Operators

operator ==(Object other) → bool
The equality operator.
inherited

Constants

cookieName → const String
Cookie name containing the CSRF token.
formFieldName → const String
Form field key used in POST/PUT forms containing the CSRF token.
headerName → const String
Request header key containing the CSRF token.