haskell-servant
Extensible CSRF handling
Several issues can be solved with an extensible method for handling CSRF. For example, #30, #53, #10, #51.
Another 'requirement': #71
I hope we can make it extensible by separating concerns instead of introducing hooks, overriding flags etc. Maybe we can delegate all XSRF logic to a record of functions that is part of the configuration. That seems quite flexible without too many bells and whistles.
I'm for removing CSRF protection now that 94% of web users can be protected against CSRF with a simple cookie flag.
The current CSRF is inflexible, buggy and annoying to work with.
(please comment here if you're using CSRF and the cookie method won't help you protect)
