I am implementing csurf module for csrf security threat in Node.js but its not working while validating the token with get request. I am explaining my code below.
var cookieParser = require('cookie-parser')
var csrf = require('csurf')
var bodyParser = require('body-parser')
var express = require('express')
// setup route middlewares
var csrfProtection = csrf({ cookie: true })
var parseForm = bodyParser.urlencoded({ extended: false })
// create express app
var app = express()
// parse cookies
// we need this because "cookie" is true in csrfProtection
app.use(cookieParser())
app.get('/form', csrfProtection, function (req, res) {
// pass the csrfToken to the view
res.send({ csrfToken: req.csrfToken() })
})
app.post('/process', parseForm, csrfProtection, function (req, res) {
res.send('data is being processed')
})
app.get('/process', parseForm, csrfProtection, function (req, res) {
res.send('data is being processed')
})
In this case for post request when validating the token it is working as expected. But for get request like app.get('/process'.... it is not validating any token. Here I need to validate the csrf token in each type request. Please help me to resolve this issue.