# Generic CSRF-token-in-meta-tag detector — covers the common conventions:
# Rails ("csrf-token"), Spring ("_csrf"), generic ("x-csrf-token", "csrf",
# "xsrf-token"). App-family-specific naming variants (e.g. the "app-csrf"
# / "app-token" form used by some apps) live in their own rule files
# (see app-meta-header.properties) so this generic rule stays predictable.

groups.count=1
detector.name=CSRF Meta Token
search.pattern=name\="(?:csrf-token|_csrf|x-csrf-token|csrf|xsrf-token)" content\="([A-Za-z0-9+/\=_-]{20,})"
detector=sread
