tmk241/hemx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(recipes): add auth csrf boundary

Browse Source 
Document the provider-explicit auth/session and CSRF boundary for the SaaS tutorial. The recipe keeps cookies, sessions, CSRF policy, and rejection behavior in Axum/Tower/app code while hemx handlers continue to receive typed context/forms and return generated effects.

req: laws/002

req: auth/001

req: auth/002

req: auth/003

req: auth/004

req: auth/005

req: failure/004

req: examples/001
This commit is contained in:
slhx agent
2026-06-05 09:30:13 +02:00
parent 2c043d2f96
commit a7012b94c2
3 changed files with 238 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+2 -2
View File
@@ -79,10 +79,10 @@ and integrate at explicit boundaries. req: laws/002 req: auth/001
commands, not own the database layer. See `docs/recipes/sqlx-persistence.md`.
- **Auth/session:** use Axum/Tower extractors and middleware. Handlers may accept
typed auth/session context and return ordinary HTTP failures or generated UI
failures. req: auth/002
failures. See `docs/recipes/auth-session-csrf.md`. req: auth/002
- **CSRF:** keep CSRF policy in middleware/extractors with hidden form fields,
cookies, and normal SameSite/browser semantics. hemx preserves submitted form
fields and credentials semantics. req: auth/004 req: auth/005
fields and credentials semantics. See `docs/recipes/auth-session-csrf.md`. req: auth/004 req: auth/005
- **Observability, feature flags, killswitches, deploy:** use explicit platform
integrations around handlers, routes, and runtime assets. Core hemx must not
vendor providers or add framework-specific magic.