How do I use CSRF protection in my Express app?

How do I use CSRF protection in my Express app?

You can use the csurf middleware in Express to protect against CSRF attacks. First, install it using npm.

What are the steps to install and set it up?

1. Install csurf: npm install csurf
2. Set up the middleware in your Express app:

   const csurf = require('csurf');
   const csrfProtection = csurf();
   app.use(csrfProtection);
   

How do I send the CSRF token to the client?

You can send the CSRF token in your response, typically in a cookie or as part of the HTML form. Use req.csrfToken() to get the token.

Can you show me an example of sending it in a form?

Sure! In your form, include a hidden input field:

<input type='hidden' name='_csrf' value='{{csrfToken}}'>

Make sure to render the token from your server.