koa-csrf
CSRF tokens for Koa
NOTE: As of v5.0.0+ ctx.csrf, ctx_csrf, and ctx.response.csrf are removed – instead use ctx.state._csrf. Furthermore we have dropped invalidTokenMessage and invalidTokenStatusCode in favor of an errorHandler function option.
Table of Contents
Install
npm:
npm install koa-csrf
Usage
-
Add middleware in Koa app (see options below):
const Koa = require('koa');
const bodyParser = require('koa-bodyparser');
const session = require('koa-generic-session');
const convert = require('koa-convert');
const CSRF = require('koa-csrf');
const app = new Koa();
// set the session keys
app.keys = [ 'a', 'b' ];
// add session support
app.use(convert(session()));
// add body parsing
app.use(bodyParser());
// add the CSRF middleware
app.use(new CSRF());
// your middleware here (e.g. parse a form submit)
app.use((ctx, next) => {
if (![ 'GET', 'POST' ].includes(ctx.method))
return next();
if (ctx.method === 'GET') {
ctx.body = ctx.state._csrf;
return;
}
ctx.body = 'OK';
});
app.listen();
-
Add the CSRF token in your template forms:
Jade Template:
form(action='/register', method='POST')
input(type='hidden', name='_csrf', value=_csrf)
input(type='email', name='email', placeholder='Email')
input(type='password', name='password', placeholder='Password')
button(type='submit') Register
EJS Template:
<form action="/register" method="POST">
<input type="hidden" name="_csrf" value="<%= _csrf %>" />
<input type="email" name="email" placeholder="Email" />
<input type="password" name="password" placeholder="Password" />
<button type="submit">Register</button>
</form>
Options
errorHandler (Function) - defaults to a function that returns ctx.throw(403, 'Invalid CSRF token')excludedMethods (Array) - defaults to [ 'GET', 'HEAD', 'OPTIONS' ]disableQuery (Boolean) - defaults to falseignoredPathGlobs (Array) - defaults to an empty Array, but you can pass an Array of glob paths to ignore
Contributors
License
MIT © Jonathan Ong
