koa-csrf

CSRF tokens for Koa

NOTE: As of v5.0.0+ ctx.csrf, ctx_csrf, and ctx.response.csrf are removed – instead use ctx.state._csrf. Furthermore we have dropped invalidTokenMessage and invalidTokenStatusCode in favor of an errorHandler function option.

Install
Usage
Options
Contributors
License

Install

npm:

npm install koa-csrf

Usage

Add middleware in Koa app (see options below):

const Koa = require('koa');
const bodyParser = require('koa-bodyparser');
const session = require('koa-generic-session');
const convert = require('koa-convert');
const CSRF = require('koa-csrf');

const app = new Koa();

// set the session keys
app.keys = [ 'a', 'b' ];

// add session support
app.use(convert(session()));

// add body parsing
app.use(bodyParser());

// add the CSRF middleware
app.use(new CSRF());

// your middleware here (e.g. parse a form submit)
app.use((ctx, next) => {
  if (![ 'GET', 'POST' ].includes(ctx.method))
    return next();
  if (ctx.method === 'GET') {
    ctx.body = ctx.state._csrf;
    return;
  }
  ctx.body = 'OK';
});

app.listen();

Add the CSRF token in your template forms:

Jade Template:

form(action='/register', method='POST')
  input(type='hidden', name='_csrf', value=_csrf)
  input(type='email', name='email', placeholder='Email')
  input(type='password', name='password', placeholder='Password')
  button(type='submit') Register

EJS Template:

<form action="/register" method="POST">
  <input type="hidden" name="_csrf" value="<%= _csrf %>" />
  <input type="email" name="email" placeholder="Email" />
  <input type="password" name="password" placeholder="Password" />
  <button type="submit">Register</button>
</form>

Options

errorHandler (Function) - defaults to a function that returns ctx.throw(403, 'Invalid CSRF token')
excludedMethods (Array) - defaults to [ 'GET', 'HEAD', 'OPTIONS' ]
disableQuery (Boolean) - defaults to false
ignoredPathGlobs (Array) - defaults to an empty Array, but you can pass an Array of glob paths to ignore