Docs

Introduction

What is rune

Philosophy

Why rune

Architecture

Getting Started

Installation

Quick start

Project structure

The dev loop

Tutorial: build an app

1. Create the app

2. Pages & routes

3. Layouts

4. State with Mimir

5. SSR & data

6. API routes

7. Styling

8. Build & deploy

Core Concepts

The application object

Rendering pipeline

Hydration

The build manifest

Configuration (ekko.json)

Permissions

Conventions

Routing

File-based routing

Dynamic routes

The router (useRouter)

Navigation & Link

Guards & redirects

Programmatic routes

Server-Side Rendering

Overview

The ssr() function

Strategies (eager/lazy)

SSR → hydration

Caching & invalidation

SEO

Mimir, state management

Overview

Atoms

Reading & writing

Selectors (derived state)

Subscriptions & the store

SSR & hydration

Persistence & sessions

Patterns & recipes

Pitfalls

Pages & Layouts

Pages

Layouts

Error & not-found

API Routes

Defining routes

Request & response

Middleware

helmet

cors

rateLimit

bodyLimit

validateContentType

csrf

requestId

timeout

errorHandler

httpsRedirect

secureCookies

ipFilter

safePath

Validation & options

Styling & Theming

SCSS

Theming (light/dark)

Asgard integration

No flash (no-FOUC)

Building & Deploying

The build

Static assets

Production deploy

API Reference

ekko:rune

ekko:rune/router

ekko:rune/mimir

ekko:rune/seo

ekko:ssr / css

ekko.json schema

CLI commands

Guides

Rune app from scratch

Recipes

Dark mode

Forms

Data fetching

Authentication

Pagination

FAQ (use cases)

`csrf()`

Stop cross-site request forgery on cookie-authenticated, state-changing requests with a rotating token.

csrf request flow

Use case

When your app authenticates with cookies, the browser sends those cookies on requests another site triggers too, so a malicious page can make a write to your API as the logged-in user. A CSRF token, which the attacker cannot read or guess, proves the request came from your own page.

How it works

Safe methods (GET, HEAD, OPTIONS) receive a fresh token in the X-CSRF-Token response header. Unsafe methods (POST, PUT, DELETE, ...) must echo a valid token back in the request header. The token is compared in constant time (no timing leak) and rotates on each successful check. A missing or invalid token replies 403. Tokens are keyed by req.sessionId (or req.ip as a fallback), so set a session id for proper per-user tokens.

Configuration

Option	Default	Notes
`header`	`"x-csrf-token"`	The request header carrying the token.

Example

00000000001
2
3
4
import { csrf } from "ekko:web";
 
app.use(csrf());                            // default header: x-csrf-token
app.use(csrf({ header: "x-xsrf-token" }));  // custom header name

Client flow: read X-CSRF-Token from a GET response, then send it as the configured header on the next POST/PUT/DELETE:

00000000001
2
3
4
5
6
7
const res = await fetch("/api/me");
const token = res.headers.get("x-csrf-token");
await fetch("/api/profile", {
  method: "POST",
  headers: { "content-type": "application/json", "x-csrf-token": token },
  body: JSON.stringify({ name }),
});

Notes

CSRF only matters with cookie auth. If your API authenticates with a Bearer token in the Authorization header (not auto-sent cross-site), CSRF does not apply and you can skip this middleware.

Next: requestId.

On this page

Use case How it works Configuration Example Notes