Home > @uniformdev/mesh-sdk > CSRF_HEADER_NAME

CSRF_HEADER_NAME variable

Default custom-header name partners attach on every state-changing call to the BFF. Any fixed, non-CORS-safelisted header name works — the value is irrelevant to the security argument; only its presence matters.

The browser will not attach a non-safelisted header on a cross-origin request without a CORS preflight, so any request that arrives with the header must have originated from same-origin JavaScript.

The constant is exported so the BFF and the consumer's browser fetch helper share one source of truth.

Signature: