csrfx

var (
	// ErrCSRFMalformed indicates the token is not valid base64url or has the
	// wrong length/version.
	ErrCSRFMalformed = errors.New("csrfx: malformed token")
	// ErrCSRFExpired indicates the token's embedded expiry is in the past.
	ErrCSRFExpired = errors.New("csrfx: token expired")
	// ErrCSRFMismatch indicates the HMAC did not verify (tampered token or
	// wrong key) or the double-submit cookie/header pair did not match.
	ErrCSRFMismatch = errors.New("csrfx: token signature mismatch")
	// ErrCSRFSessionMismatch indicates the token was issued for a different
	// session than the one presenting it.
	ErrCSRFSessionMismatch = errors.New("csrfx: token session mismatch")
	// ErrKeyTooShort indicates the signing key is shorter than the 32-byte
	// minimum.
	ErrKeyTooShort = errors.New("csrfx: signing key must be at least 32 bytes")
)