Joonas Westlin

Also I need to update this sample with that default forbid scheme because if it isn't set, the default challenge scheme is used as fallback. And we don't usually want...

At the moment no. The rules are set for all routes. An improvement could be the ability to modify rules for that request in some kind of handler.

Yeah, it might be :) I'm not really sure how you'd implement that though since you'd have to somehow resolve the script content about to be sent, calculate the hash,...

As far as I know, you cannot affect the violation report requests enough to include a CSRF token. Cookies should go with the request I think.

This looks like it could be useful :) Accepting PRs for this, I don't have time to do this right now.

That could be a nice addition. I'll have to check how the standard one compares to that one.

I always appreciate PRs :)

I haven't tried, but I imagine it would not work as Functions middleware are very different. The way you access request data etc. are different.

Thank you for the pull request. I will check it out in more detail once I have some time. There are a lot of code style issues though that must...

Thanks for bringing this up, I'll get it fixed up :)