# Tests CSRF request header token protection.
csrf_test.protected:
  path: csrf/protected
  defaults:
    _controller: '\Drupal\csrf_test\Controller\TestController::testMethod'
  requirements:
    _csrf_request_header_token: 'TRUE'
    _method: 'POST'
csrf_test.route_with_csrf_token:
  path: csrf/protected/route
  defaults:
    _controller: '\Drupal\csrf_test\Controller\TestController::testMethod'
  requirements:
    _permission: 'administer site configuration'
    _csrf_token: 'TRUE'
