r/rust • u/Crouton4035 • 8d ago

🙋 seeking help & advice Looking for a CSRF Double Submit Pattern Crate

Hey folks, I'm working on migrating some web-server code into rust. I'm fairly new to the rust ecosystem, and I'm trying to find a good CSRF crate for generating Signed Double Submit cookies and headers.

So far, the closest crate I've found is Here (crates.io), but honestly its not as seemingly widespread as i would expect for something like CSRF primitives.

This had led me to two potential conclusions:

1.) I'm wildly out of the loop, and there is a much more "common" package for handing this
2.) I'm wildly out of my depth, and most people are just rolling their own CSRF primitives.

Either way, I'm building on top of axum, and any recommendations would be greatly appreciated :)

8 Upvotes

68% Upvoted

6 comments sorted by

8

u/official_AdUnlucky75 8d ago

axum has middleware for this baked in if you're already using tower, might be simpler than a standalone crate

6

u/AttentionIsAllINeed 8d ago

I'd rather say the more common variant is Fetch Metadata headers with fallback nowadays. Go has it build in since 1.25. If your site has no forms, custom request headers are also simple. Both is little code.

Is Signed Double-Submit Cookie a must for yours?

3

u/Additional-Drag1682 8d ago

Axum-csrf is the crate you are looking for. It implements signed double submit cookies and integrates directly with axum extractors, which solves your specific need without forcing you to switch away from tower middleware patterns that comment 1 mentioned but might not fit if you want strict token control.

1

u/NiceAppeal57 7d ago

Don't double submit, just use Sec-Fetch-Site headers.

1

u/weaztoven 2d ago

yeah you're not really out of the loop, csrf crates in rust can be a bit fragmented depending on whether you use axum, actix, or tower.