import type { Plugin } from './app';
import type { CookieOptions } from './cookies';
/** Options for {@link csrf}. */
export interface CsrfOptions {
    /** Cookie holding the CSRF token. Default `"csrf-token"`. */
    cookie?: string;
    /** Request header that must echo the token on unsafe requests. Default `"x-csrf-token"`. */
    header?: string;
    /** Methods that need no token and mint one if absent. Default `GET`/`HEAD`/`OPTIONS`. */
    safeMethods?: string[];
    /**
     * Cookie attributes for the minted token. Defaults to `SameSite=Strict` and
     * `Path=/`. The cookie is deliberately readable by client JS (not `HttpOnly`)
     * so the page can echo it into {@link CsrfOptions.header}.
     */
    cookieOptions?: CookieOptions;
}
/**
 * Plugin: CSRF protection via the double-submit-cookie pattern. On a safe
 * request (`GET`/`HEAD`/`OPTIONS`) it mints a random token cookie if absent; on
 * an unsafe request it requires a header whose value matches that cookie,
 * replying `403 Forbidden` otherwise. The guarantee rests on the same-origin
 * policy: a cross-site attacker can neither read the cookie to forge the header
 * nor set the custom header without a (blocked) preflight. Pair it with
 * `SameSite` cookies (the default here) for defence in depth.
 *
 * ```ts
 * const app = await createApp({ plugins: [csrf()] })
 * // Browser: read the `csrf-token` cookie, send it as `x-csrf-token` on writes.
 * ```
 *
 * @remarks Stateless: the token is a random per-browser UUID, minted once and
 * reused (never rotated), with no server-side record. It therefore does not
 * defend against XSS or a same-site attacker who can write the cookie (e.g. from
 * a sibling subdomain) — those need a session-bound token instead.
 *
 * @param options - cookie/header names, safe methods, and minted-cookie attributes
 * @returns a plugin enforcing double-submit-cookie CSRF protection
 */
export declare function csrf(options?: CsrfOptions): Plugin;
//# sourceMappingURL=csrf.d.ts.map