---
name: "up.protocol.config"
area: "API"
kind: "Configuration object"
parent: "up.protocol module"
url: "https://unpoly.com/api/up.protocol.config"
---
<nav aria-label="Unpoly docs">[All docs](https://unpoly.com/index.md) · [up.protocol module](https://unpoly.com/api/up.protocol.md)</nav>

# up.protocol.config

Configures strings used in the optional [server protocol](https://unpoly.com/api/up.protocol.md).

---

## Value {#value}

### CSRF {#value-csrf}

#### [config.csrfHeader='X-CSRF-Token'] {#config.csrfHeader}

(optional)

The name of the HTTP header that will include the [CSRF token](https://en.wikipedia.org/wiki/Cross-site_request_forgery#Synchronizer_token_pattern) for requests made by Unpoly.

Type: string

#### [config.csrfParam] {#config.csrfParam}

(optional)

The `name` of the hidden `<input>` used for sending a [CSRF token](https://en.wikipedia.org/wiki/Cross-site_request_forgery#Synchronizer_token_pattern) when the browser submits a form without Unpoly. For requests made by Unpoly the token is sent as an [HTTP header](https://unpoly.com/api/up.protocol.config.md#config.csrfHeader) instead.

The parameter name can be configured as a string or as function that returns the parameter name. If no name is set, no token will be sent.

Defaults to the `content` attribute of a `<meta>` tag named `csrf-param`:

```html
<meta name="csrf-param" content="authenticity_token">
```

Type: string | Function(): string

#### [config.csrfToken] {#config.csrfToken}

(optional)

The [CSRF token](https://en.wikipedia.org/wiki/Cross-site_request_forgery#Synchronizer_token_pattern) to send for unsafe requests. The token will be sent as either an HTTP header (for requests made by Unpoly) or a hidden form `<input>` (for form submissions without Unpoly).

The token can either be configured as a string or as function that returns the token. If no token is set, no token will be sent.

Defaults to the `content` attribute of a `<meta>` tag named `csrf-token`:

```
<meta name='csrf-token' content='secret12345'>
```

Type: string | Function(): string

### Method wrapping {#value-method-wrapping}

#### [config.methodParam='_method'] {#config.methodParam}

(optional)

The name of request parameter containing the original request method when Unpoly needs to [wrap](https://unpoly.com/api/up.network.config.md#config.wrapMethod) the method.

Methods must be wrapped when making a [full page request](https://unpoly.com/api/up.network.loadPage.md) with a methods other than GET or POST. In this case Unpoly will make a POST request with the original request method in a form parameter named `_method`:

```http
POST /test HTTP/1.1
Host: example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 11

_method=PUT
```

Type: string

### Header size {#value-header-size}

#### [config.maxHeaderSize] (Experimental) {#config.maxHeaderSize}

(optional)

The preferred maximum length of an `X-Up`-prefixed header's value.

This is currently only honored for [`X-Up-Validate`](https://unpoly.com/api/X-Up-Validate.md).

Type: number