csrf-validator

A CSRF validator library for Node.js and Nestjs.

Using this library will let you directly configure CSRF Validator for your app without a cookie-parser as it is already built in.

You will have an option to manually add cookie parser as well.

Installation

This package is published over npm registry.

$ npm install csrf-validator

Implementation

There are two types of implementations available.

1. Without configuring cookie-parser and cookie-session
2. With configuring cookie-parser and cookie-session manually

1. Without configuring cookie-parser and cookie-session

In this method, you don't have to configure cookie-parser and cookie-session manually, it will automatically get configured

Express.js

var express = require('express');

var app = express();

CSRFValidator.instance(
        {
          tokenSecretKey: 'A secret key for encrypting csrf token',
          ignoredMethods: [],
          ignoredRoutes: ['/login'],
          entryPointRoutes: ['/login'],
          cookieKey: 'Optional - Custom csrf cookie key',
          cookieSecretKey: 'Cookie secret key for cookie-parser',
          cookieSessionKeys: [
            'First session key for cookie-session',
            'Second session key for cookie-session'
          ]
        }
).configureApp(app);

NestJS

import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);

  CSRFValidator.instance(
          {
            tokenSecretKey: 'A secret key for encrypting csrf token',
            ignoredMethods: [],
            ignoredRoutes: ['/login'],
            entryPointRoutes: ['/login'],
            cookieKey: 'Optional - Custom csrf cookie key',
            cookieSecretKey: 'Cookie secret key for cookie-parser',
            cookieSessionKeys: [
              'First session key for cookie-session',
              'Second session key for cookie-session'
            ]
          }
  ).configureApp(app);
}

2. With configuring cookie-parser and cookie-session manually

In this method, you have to configure cookie-parser and cookie-session manually

Express.js

var express = require('express');
var cookieSession = require('cookie-session');
var cookieParser = require('cookie-parser');

var app = express();
app.use(cookieParser('Cookie secret key for cookie-parser'));
app.use(cookieSession({
  keys: [
    'First session key for cookie-session',
    'Second session key for cookie-session'
  ]
}));

app.use(CSRFValidator.instance({
  tokenSecretKey: 'A secret key for encrypting csrf token',
  ignoredMethods: [],
  ignoredRoutes: ['/login'],
  entryPointRoutes: ['/login'],
  cookieKey: 'Optional - Custom csrf cookie key'
}).configure());

NestJS

import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';
import * as cookieSession from 'cookie-session';
import * as cookieParser from 'cookie-parser';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  app.use(cookieParser('Cookie secret key for cookie-parser'));
  app.use(cookieSession({
    keys: [
      'First session key for cookie-session',
      'Second session key for cookie-session'
    ]
  }));

  app.use(CSRFValidator.instance({
    tokenSecretKey: 'A secret key for encrypting csrf token',
    ignoredMethods: [],
    ignoredRoutes: ['/login'],
    entryPointRoutes: ['/login'],
    cookieKey: 'Optional - Custom csrf cookie key'
  }).configure());
}

Configuration

Just like demonstrated above, you have to call either CSRFValidator.instance().configreApp(app) or app.use(CSRFValidator.instance().configreApp()) with CSRFValidatorOptions to configure.

CSRFValidatorOptions

Field	Usage	Example
tokenSecretKey	This is a secret key used to encrypt CSRF tokens	'6e655c9df6374cfa8a2d77c5f5d7d'
ignoredMethods	Array of methods, those will be ignored at the time of CSRF token verification. But still won't set any token in response.	['GET', 'POST']
ignoredRoutes	Array of routes, those will be ignored at the time of CSRF token verification. But still won't set any token in response.	['/login', '/user']
entryPointRoutes	Array of routes, if the routes ignored like above, you still need a starting point. Setting entry point routes will treat those routes to set the CSRF token in response.	['/login']
cookieKey	This is an optional filed. You can customize the token key name using this field	'custom-csrf-cookie'
cookieSecretKey	This is a secret key to setup cookie-parser	'5edc865af772d214c6d9893b57a51'
cookieSessionKeys	This is an array of secret keys to setup cookie-session	['7f6cb6e3c9cefd7b2c6b76826516d', 'ff675b9dcb1d6324d96789ef939b1']

License

MIT