Cross-Site Request Forgery (CSRF) middleware for Express
Heavily inspired by and based on csurf. This module aims to be more flexible than other CSRF modules by being split into two separate middleware: one that handles the CSRF token generation and one that handles the CSRF token validation.
yarn add @ianwalter/express-csrfUse the csrfGeneration middleware before you intend to use the
req.generateCsrfToken method to generate a CSRF token:
const { csrfGeneration } = require('@ianwalter/express-csrf')
app.use(csrfGeneration)Use the csrfValidation middleware before any endpoints you want to protect
from CSRF attacks:
const { csrfValidation } = require('@ianwalter/express-csrf')
// Doesn't need to be proected:
app.post('/login', session.create)
app.use(csrfValidation)
// Protected:
app.post('/order', orders.create)Apache 2.0 with Commons Clause - See LICENSE
Created by Ian Walter