level-session-csrf
Connect middleware that implements csrf tokens backed by a level-session store. API-compatible with connect/csrf.
Usage
var csrf = ; var sessiondb = location: path expire: appSESSION_TTL keys: configsecrets ; var app = ; app; app;
Then to add the token to the locals for any specific request:
response;
The middleware by default assumes that you are providing the token in a form or query parameter named _csrf
, or in a request header called x-csrf-token
or x-xsrf-token
.
Options
You can optionally pass an options object to csrf()
to specify a custom value-checking function. The value-checking function is passed the request object, which it may inspect as it wishes. The function must return a token string. For instance, if you wanted to look at a custom form parameter instead of _csrf
:
{ return requestbodymy_form_parameter;} var options = 'value': customValue ;app;
LICENSE
MIT.