Minor verison of Yii CSRF package was released.

• Add the CsrfHeaderMiddleware middleware to use custom HTTP header to prevent forgery of requests.
• Add the CsrfMiddleware::withSafeMethods() method to configure a custom safe HTTP methods list.
• Deprecate CsrfMiddleware in favor of CsrfTokenMiddleware.

Minor verison of Yii CSRF package was released.

• Added StubCsrfToken.
• Explicitly added transitive dependencies yiisoft/strings, psr/http-server-handler and ext-hash.

Version 2.0 of Yii CSRF package was released.

In this version configuration group names adapted to Yii conventions and added support of yiisoft/session version ^2.0.

Minor verison of CSRF package was tagged adding ability to specify your own failure handler:

use Psr\Http\Message\ResponseFactoryInterface;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Server\RequestHandlerInterface;
use Yiisoft\Csrf\CsrfMiddleware;

/**
 * @var Psr\Http\Message\ResponseFactoryInterface $responseFactory
 * @var Yiisoft\Csrf\CsrfTokenInterface $csrfToken
 */
 
$failureHandler = new class ($responseFactory) implements RequestHandlerInterface {
    private ResponseFactoryInterface $responseFactory;
    
    public function __construct(ResponseFactoryInterface $responseFactory)
    {
        $this->responseFactory = $responseFactory;
    }

    public function handle(ServerRequestInterface $request): ResponseInterface
    {
        $response = $this->responseFactory->createResponse(400);
        $response->getBody()->write('Bad request.');
        return $response;
    }
};

$middleware = new CsrfMiddleware($responseFactory, $csrfToken, $failureHandler);

Minor verison of CSRF package was tagged adding ability to obtain parameter and header names set to the middleware via CsrfMiddleware::getParameterName() and CsrfMiddleware::getHeaderName().