Hoogle Search
Within LTS Haskell 24.65 (ghc-9.10.3)
Note that Stackage only displays results for the latest LTS and Nightly snapshot. Learn more.
-
yesod-core Yesod.Core Looks up the CSRF token from the request headers or POST parameters. If the value doesn't match the token stored in the session, this function throws a PermissionDenied error. For details, see the "AJAX CSRF protection" section of Yesod.Core.Handler. Since 1.4.14
csrfSetCookieMiddleware :: HandlerFor site res -> SetCookie -> HandlerFor site resyesod-core Yesod.Core Takes a SetCookie and overrides its value with a CSRF token, then sets the cookie. See setCsrfCookieWithCookie. For details, see the "AJAX CSRF protection" section of Yesod.Core.Handler. Make sure to set the setCookiePath to the root path of your application, otherwise you'll generate a new CSRF token for every path of your app. If your app is run from from e.g. www.example.com/app1, use app1. The vast majority of sites will just use /. Since 1.4.14
defaultCsrfCheckMiddleware :: Yesod site => HandlerFor site res -> HandlerFor site resyesod-core Yesod.Core Calls csrfCheckMiddleware with isWriteRequest, defaultCsrfHeaderName, and defaultCsrfParamName as parameters. Since 1.4.14
defaultCsrfMiddleware :: Yesod site => HandlerFor site res -> HandlerFor site resyesod-core Yesod.Core Calls defaultCsrfSetCookieMiddleware and defaultCsrfCheckMiddleware. For details, see the "AJAX CSRF protection" section of Yesod.Core.Handler. You can chain this middleware together with other middleware like so:
yesodMiddleware = defaultYesodMiddleware . defaultCsrfMiddleware
or:yesodMiddleware app = defaultYesodMiddleware $ defaultCsrfMiddleware $ app
Since 1.4.14defaultCsrfSetCookieMiddleware :: HandlerFor site res -> HandlerFor site resyesod-core Yesod.Core Calls csrfSetCookieMiddleware with the defaultCsrfCookieName. The cookie's path is set to /, making it valid for your whole website. Since 1.4.14
defaultMessageWidget :: Yesod site => Html -> HtmlUrl (Route site) -> WidgetFor site ()yesod-core Yesod.Core Convert a title and HTML snippet into a Widget. Used primarily for wrapping up error messages for better display.
defaultYesodMiddleware :: Yesod site => HandlerFor site res -> HandlerFor site resyesod-core Yesod.Core Default implementation of yesodMiddleware. Adds the response header "Vary: Accept, Accept-Language", "X-XSS-Protection: 1; mode=block", and performs authorization checks. Since 1.2.0
liftWidget :: MonadWidget m => WidgetFor (HandlerSite m) a -> m ayesod-core Yesod.Core No documentation available.
sslOnlyMiddleware :: Int -> HandlerFor site res -> HandlerFor site resyesod-core Yesod.Core Apply a Strict-Transport-Security header with the specified timeout to all responses so that browsers will rewrite all http links to https until the timeout expires. For security, the max-age of the STS header should always equal or exceed the client sessions timeout. This defends against SSL-stripping man-in-the-middle attacks. It is only effective if a secure connection has already been made; Strict-Transport-Security headers are ignored over HTTP. Since 1.4.7
urlParamRenderOverride :: Yesod site => site -> Route site -> [(Text, Text)] -> Maybe Builderyesod-core Yesod.Core Override the rendering function for a particular URL and query string parameters. One use case for this is to offload static hosting to a different domain name to avoid sending cookies. For backward compatibility default implementation is in terms of urlRenderOverride, probably ineffective Since 1.4.23