CODEWITHSUNDEEP
node.jsexpresscsrf
bear
bear

Reputation: 1348

How do I generate CSRF tokens in Express?

newbie. I'm using ExpressJS/Node. Here's my config stuff:

var express = require('express'),
app = express.createServer(),
jade=require('jade');
// Configuration
app.configure(function(){
app.set('views', __dirname + '/views');
app.use(express.logger());
app.use(express.cookieParser());
app.use(express.session({ secret: "secretive secret" }));
app.set('view engine', 'jade');
app.use(express.bodyParser());
app.use(express.methodOverride());
app.use(require('stylus').middleware({ src: __dirname + '/public' }));
app.use(app.router);
app.use(express.static(__dirname + '/public'));
app.use(express.csrf());

I found csrf.js in Express directories, and see that it should be generated and assigned to req.body._csrf, but I'm not sure how to access it.

Here's the csrf.js code

module.exports = function csrf(options) {
var options = options || {}
, value = options.value || defaultValue;

return function(req, res, next){
// generate CSRF token
var token = req.session._csrf || (req.session._csrf = utils.uid(24));

// ignore GET (for now)
if ('GET' == req.method) return next();

// determine value
var val = value(req);

// check
if (val != token) return utils.forbidden(res);

next();
}
};

Help? Thanks!

Upvotes: 9

Views: 16319

Answers (4)

Kevin
Kevin

Reputation: 69

If you also want to set a secure cookie for your CSRF token that can be read by your frontend (angular for example), you can do this:

app.use csrf()

app.use (req, res, next) ->
  res.cookie('XSRF-TOKEN', req.csrfToken(), {secure: true})
next()

Upvotes: 0

Nur Rony
Nur Rony

Reputation: 8083

In Express 4.x this middleware is removed. For Express 4.x you can do it as follows

var csrf = require('csurf');
app.use(csrf());

Ah!! you need to register the csrf middleware after your session and cookieParser middleware.

Inside Route Or Ctrl

res.render('someform', { csrf: req.csrfToken() });

or You can set a local variable also like so 

app.use(function(req, res, next){
  res.locals.csrf = req.csrfToken();
});

Then in view 

input(type="hidden", name="_csrf", value="#{csrf}")

You are done!! :)

Upvotes: 1

chenglou
chenglou

Reputation: 3640

Dynamic helpers has been removed from Express since 3.x.

The new usage would be app.use(express.csrf());, which comes from Connect.

Upvotes: 19

fent
fent

Reputation: 18217

Add the token to dynamic helpers.

app.dynamicHelpers({
  token: function(req, res) {
    return req.session._csrf;
  }
});

Reference it in your jade template.

input(type='hidden', value=token)

Source: http://senchalabs.github.com/connect/middleware-csrf.html

Upvotes: 5

Related Questions