csrf-csrf

import express from 'express'; import cookieParser from 'cookie-parser'; import { doubleCsrf } from 'csrf-csrf'; import { Request, Response } from 'express'; const app = express(); const port = 3000; // Initialize doubleCsrf with a secret. // For production, use a strong, securely generated secret from environment variables. const { doubleCsrfProtection, generateToken, } = doubleCsrf({ secret: process.env.CSRF_SECRET ?? 'your-very-strong-and-secret-key-that-you-must-change-in-prod-12345', cookieName: 'x-csrf-token', cookieOptions: { httpOnly: true, sameSite: 'lax', // 'Lax' or 'Strict' is recommended for CSRF protection secure: process.env.NODE_ENV === 'production', }, getTokenFromRequest: (req: Request) => { // IMPORTANT: Be explicit here. Do not use fallthroughs (||, ??). // Prioritize header, then body. If not found, return an empty string. if (req.headers['x-csrf-token']) { return req.headers['x-csrf-token'] as string; } if (req.body && req.body._csrf) { return req.body._csrf; } return ''; }, }); app.use(express.json()); // For parsing application/json app.use(express.urlencoded({ extended: true })); // For parsing application/x-www-form-urlencoded app.use(cookieParser(process.env.COOKIE_SECRET ?? 'your-cookie-secret-for-signing-if-needed')); // Use a separate secret for cookie-parser // CSRF protection middleware must be after cookie-parser app.use(doubleCsrfProtection); // Route to get a new CSRF token for the frontend app.get('/csrf-token', (req: Request, res: Response) => { const csrfToken = generateToken(req); res.json({ csrfToken }); }); // Example protected POST route app.post('/submit-data', (req: Request, res: Response) => { // If the doubleCsrfProtection middleware didn't throw an error, // the request is considered valid. res.json({ message: 'Data submitted successfully!', received: req.body }); }); app.listen(port, () => { console.log(`Server listening on port ${port}`); });