Opt out CSRF per route

[florian-lefebvre]

Body

Summary

Allow to opt out of CSRF protection per route.

Background & Motivation

While it's good practice to have CSRF enable for an entire Astro project, there are cases where not having CSRF enabled for a specific route is required. One example is a webhook, read Stripe docs.

Goals

• Having a way to opt-out CSRF protection for a given route

Example

export const checkOrigin = false;

The risk of this API is to have too many per-route setting (like prerender) so it may need a RFC before to to tackle this topic (discord thread)

[mseibert]

We would need this in our projects.

[florian-lefebvre]

I don't think this is likely to move anytime soon FYI. Ping me on the related private issue so we can discuss alternatives