Boolean IDP rule condition that checks whether the request carries a valid CSRF token in the K-CSRF header. Validation is a no-op (always true) when the policy has no signing keys configured; otherwise the token is checked against each configured key and must be both correctly signed and within the policy's validity window. On success the token's user id is recorded as the allowed profile for the request (a user id of zero permits only anonymous access).

Group: IDP Rules

Implements: IDPHttpExpression