/**
 * CSRF protection via an **Origin / Referer check** on state-changing requests - OWASP's recommended
 * defense for cookie-authenticated apps. A browser always attaches `Origin` (or at least `Referer`) to
 * a cross-origin or same-origin *unsafe* request; it must match an allowed origin, else `403`. Safe
 * methods (GET/HEAD/OPTIONS) pass. Apply with `app.use(csrf({ origins: ["https://example.com"] }))`.
 */
import { type Middleware } from "@nifrajs/core/server";
export interface CsrfOptions {
    /**
     * Allowed origins (e.g. `["https://example.com"]`). When omitted, the request must be same-origin by
     * host (an `https:` page reaching an `http:` request URL is accepted, so a TLS-terminating proxy
     * works). Set it when the proxy rewrites `Host`, so the public origin differs from the worker's.
     */
    readonly origins?: readonly string[];
}
export declare function csrf(options?: CsrfOptions): Middleware;
//# sourceMappingURL=csrf.d.ts.map