This npm module is currently deprecated due to the large influx of security vulnerability reports received, most of which are simply exploiting the underlying limitations of CSRF itself. The Express.js project does not have the resources to put into this module, which is largely unnecessary for modern SPA-based applications.

Please instead use an alternative CSRF protection package if you do need one: https://www.npmjs.com/search?q=express%20csrf

What is cross-site request forgery (CSRF)?

What is the double submit cookie pattern?

What makes csurf vulnerable to CSRF?

• Validating request origin
• Adding a cookie prefix
• Using server sessions

Validating request origin

Adding a cookie prefix

app.use(csrf({
    cookie: {
        key: ‘__Host-token’,
        path: ‘/’,
        secure: true
    }
});

Using server sessions

1. Install the express-session package: npm install express-session.
2. Initialize the express-session package: const session = require(‘express-session’);.
3. Set up the express-session package: 

const app = express()
app.use(session({
    secret: ‘<load secure secret from environment or storage solution>’,
    cookie: {
        path: ‘/’,
        secure: true,
        httpOnly: true,
        sameSite: ‘strict’
    },
    saveUninitialized: false,
    resave: false
}));

1. Set up the csurf package:

const csrf = require(‘csurf’);
const csrfProtection = csrf();

1. Set the csrfToken in any pages that can be susceptible to CSRF attacks:

app.get(‘/form, csrfProtection, (req, res) => {
    res.render(‘index.ejs’, { csrfToken: req.csrfToken() });
});

1. Add the csrfToken as a hidden field in your views:

<form method="POST" action="/process">
    <p>Title: <input type="text" name="title" /></p>
    <p>Name: <input type="text" name="name" /></p>
    <p><input type="submit" value="Submit" /></p>
    <input type="hidden" name="_csrf" value="<%= csrfToken %>" /
</form>

1. Set up the route that accepts your view requests with csrfProtection:

app.post(‘/process’, csrfProtection, (req, res) => {
	// your route code goes here
});