Implement CSRF Protection with Tokens in Express.js

const express = require('express');
const cookieParser = require('cookie-parser');
const csurf = require('csurf');
const bodyParser = require('body-parser');

const app = express();

app.use(cookieParser());
app.use(bodyParser.urlencoded({ extended: false }));
app.use(csurf({ cookie: true })); // Use cookie-based CSRF tokens

// Middleware to make CSRF token available to templates (e.g., Pug, EJS)
app.use((req, res, next) => {
  res.locals.csrfToken = req.csrfToken();
  next();
});

app.get('/', (req, res) => {
  // In a real app, you'd render an HTML form with a hidden input for csrfToken
  res.send(`
        <form action="/process" method="POST">
          <input type="hidden" name="_csrf" value="${req.csrfToken()}">
          <input type="text" name="message" placeholder="Your message">
          <button type="submit">Submit</button>
        </form>
        <p>CSRF Token (for debugging): ${req.csrfToken()}</p>
      `);
});

app.post('/process', (req, res) => {
  // CSRF token is automatically validated by csurf middleware before reaching here
  res.send(`Data received: ${req.body.message}. CSRF token validated.`);
});

app.use((err, req, res, next) => {
  if (err.code !== 'EBADCSRFTOKEN') return next(err);
  res.status(403).send('Invalid CSRF Token. Request blocked.');
});

app.listen(3000, () => console.log('App running on http://localhost:3000'));