# `StarView.Plug.RenameCsrfParam`
[🔗](https://github.com/Neophen/star_view/blob/v0.7.0/lib/star_view/plug/rename_csrf_param.ex#L1)

Copies a Datastar CSRF signal into `_csrf_token` for `Plug.CSRFProtection`.

POST/PUT/PATCH signals arrive in parsed body params. GET/DELETE signals
arrive in the JSON `datastar` query parameter. Existing body `_csrf_token`
values take precedence; a query `_csrf_token` cannot suppress a valid body
or Datastar token. Tokens in GET/DELETE URLs should be redacted from logs.
Sending an `x-csrf-token` header does not remove the signal from the query;
also exclude that signal from URL-based requests if using headers instead.

If the body is still unfetched, query/params tokens are copied to the request
header instead of body params so later signal fetching can consume the raw
body. An explicit `x-csrf-token` header is preserved.

Add it before `:protect_from_forgery` when using Datastar form mode:

    plug StarView.Plug.RenameCsrfParam
    plug :protect_from_forgery