A Plug to protect against Cross-Site Request Forgery (CSRF) attacks using modern header-based checks instead of tokens.

Based on Filippo Valsorda's blog post and the Go 1.25 net/http CrossOriginProtection.

Modern browsers (since 2023) send the Sec-Fetch-Site header which reliably indicates whether a request is same-origin, same-site, cross-site, or user-initiated. This plug uses that header (with a fallback to Origin header comparison) to reject cross-origin requests without requiring CSRF tokens.

1. Safe methods (GET, HEAD, OPTIONS) are always allowed
2. If Origin header matches a trusted origin, the request is allowed
3. If Sec-Fetch-Site is same-origin or none, the request is allowed
4. If Sec-Fetch-Site indicates cross-origin, the request is rejected
5. If no headers are present, the request is allowed (non-browser client)
6. If only Origin is present, it's compared against the Host header

Add plug_cross_origin_protection to your list of dependencies in mix.exs:

def deps do
  [
    {:plug_cross_origin_protection, "~> 0.2"}
  ]
end

If you're using Phoenix, PlugCrossOriginProtection is a direct replacement for the protect_from_forgery helper which invokes Plug.CSRFProtection.

# In your YourAppWeb.Router
- plug :protect_from_forgery
+ plug PlugCrossOriginProtection

For SSO callbacks or partner integrations:

plug PlugCrossOriginProtection,
  trusted_origins: [
    "https://sso.example.com",
    "https://partner.example.com"
  ]

• Safe methods: Ensure your application never performs state-changing actions on GET, HEAD, or OPTIONS requests
• HTTPS: Use HTTPS in production. The Sec-Fetch-Site header is only sent to secure origins
• HSTS: Consider using HTTP Strict Transport Security to protect against HTTP→HTTPS attacks on older browsers
• Browser support: Sec-Fetch-Site is supported in all major browsers since 2023. Older browsers fall back to Origin/Host comparison

MIT License. See LICENSE for details.