express-csrf-double-submit-cookie

Express CSRF token middleware with "Double submit cookie"

Requires cookie-parser to be initialized first.

Installation

$ npm install express-csrf-double-submit-cookie

Usage

const cookieParser = require('cookie-parser')
const csrfDSC = require('express-csrf-double-submit-cookie')
const express = require('express')

// create middleware
const csrfProtection = csrfDSC();

const app = express();
app.use(cookieParser());

// middleware to set cookie token 
app.use(csrfProtection)

// protect /api
app.post('/api', csrfProtection.validate, function (req, res) {
  res.status(200).end();
})

API

const csrfDSC = require('express-csrf-double-submit-cookie')
const csrfProtection = csrfDSC([options]);

Options

• length - token length in bytes. Default to 18.
• value - function to get token from request. Default to

function defaultValue (req) {
    return (req.body && req.body._csrf_token) ||
        (req.query && req.query._csrf_token) ||
        (req.headers['x-csrf-token']);
}

• cookie - Cookie options, see express res.cookie() documentation. Defaults to { name: '_csrf_token', path: '/', httpOnly: false }