Strict GET Method Plugin

Enhances security by ensuring only procedures explicitly marked to accept GET requests can be called using HTTP GET for RPC Protocol. Helps prevent certain CSRF attacks.

When to Use

Beneficial if your application stores sensitive data (session/auth tokens) in cookies with SameSite=Lax or SameSite=None.

Enabled by default for HTTP Adapter. You may switch to Simple CSRF Protection or disable entirely.

How it works

Only procedures configured with method: 'GET' can be invoked via GET requests:

import { os } from '@orpc/server'

const ping = os
  .route({ method: 'GET' })
  .handler(() => 'pong')

Setup

import { StrictGetMethodPlugin } from '@orpc/server/plugins'

const handler = new RPCHandler(router, {
  plugins: [
    new StrictGetMethodPlugin()
  ],
})