NAME
    CGI::Application::Plugin::ProtectCSRF - Plug-in protected from CSRF

VERSION
    0.02

SYSNPSIS
      use Your::App;
      use CGI::Application::Plugin::Session; # require!!
      use CGI::Application::Plugin::ProtectCSRF;

DESCRIPTION
    CGI::Application::Plugin::ProtectCSRF is C::A::P protected from CSRF.

    When CSRF is detected, 403 Forbidden is returned and processing is
    interrupted.

METHOD
  add_postonly_runmodes
    Runmodes set to runmodes returns add_postonly_runmodes "Forbidden"
    excluding POST Request.

    Example :

      sub setup { # or cgiapp_init

         my $self = shift;
         ....
         # When requests other than POST come to mode1, mode2, and mode3, Forbidden is 
         # returned.
         $self->add_postonly_runmodes(qw(mode1 mode2 mode3));
      }

  delete_postonly_runmodes
    To cancel runmode set with add_postonly_runmodes, it executes it.

    Example :

      $self->delete_postonly_runmodes(qw(mode1 mode2 mode3));

  clear_csrfid
    Clear csrfid. It is preferable to make it execute after processing ends.

    Input screen => confirmation screen => completion screen(here!!)

    Example :

      sub input {
        my $self = shift;
        ....
      }
  
      sub confirm {
        my $self = shift;
        ....
      }

      sub complete {
        my $self = shift;
        ...process start(DB insert etc..)
        $self->clear_csrfid;
        ....
      }

  is_post_request
    Check request method.If request method is POST, 1 is returned.

    Example :

      my $post_flag;
      if($self->is_post_request){
         # $self->query->request_method or $ENV{REQUEST_METHOD} is POST
      }else{
         # not POST
      }

CAUTION
    It has only the protection function of basic CSRF,and mount other
    security checks in the application, please.

SEE ALSO
    Carp CGI::Application CGI::Application::Plugin::Session Exporter
    Digest::SHA1 HTML::TokeParser List::Util

AUTHOR
    Akira Horimoto <kurt0027@gmail.com>

COPYRIGHT
    Copyright (C) 2006 Akira Horimoto

    This module is free software; you can redistribute it and/or modify it
    under the same terms as Perl itself.

