How can I implement CSRF protection in my Express.js application?

How can I implement CSRF protection in my Express.js application?

To implement CSRF protection in Express.js, you can use the csurf middleware. First, install it using npm.

What are the steps to set it up?

1. Install csurf and cookie-parser. 2. Set up cookie parsing middleware. 3. Use csurf middleware in your routes.

Can you show me a code example?

Sure! Here's a basic example:

const express = require('express');
const cookieParser = require('cookie-parser');
const csrf = require('csurf');

const app = express();
app.use(cookieParser());
app.use(csrf({ cookie: true }));

app.get('/form', (req, res) => {
  res.send(`<form action="/submit" method="POST">
    <input type="hidden" name="_csrf" value="${req.csrfToken()}">
    <button type="submit">Submit</button>
  </form>`);
});

app.post('/submit', (req, res) => {
  res.send('Form submitted successfully!');
});

app.listen(3000);

What if I want to use session-based CSRF protection instead?

You can configure csurf to use session storage instead of cookies. Just ensure you have session middleware set up.