Yesod 1.2 CSRF protection

Question

I'm confused about Yesod's CSRF protection, and how Yesod's forms work in general. It's my understanding that Yesod's form system uses a "token" which is passed into the HTML realization of the form as a hidden field. When the form is processed, the token is compared to one stored (or at least recreated) on the server. I'd like to track that down, because the CSRF protection is being triggered spuriously in my development environment, and I'd like to change my environment so the forms work the same in development as in production.

So what does Yesod's CSRF token "depend on"?

Answer 1

The token is stored in the user session. You can get access to it via:

fmap reqToken getRequest