Implementing Cross-Site Request Forgery (CSRF) Protection

const express = require('express');
const cookieParser = require('cookie-parser');
const session = require('express-session');
const csurf = require('csurf');

const app = express();

app.use(express.urlencoded({ extended: false })); // For parsing application/x-www-form-urlencoded
app.use(cookieParser());

// Configure session middleware (required for csurf to store token)
app.use(session({
  secret: 'your-very-strong-secret-key-here-for-sessions',
  resave: false,
  saveUninitialized: true,
  cookie: { secure: process.env.NODE_ENV === 'production' } // Use secure cookies in production
}));

// CSRF middleware
app.use(csurf({ cookie: true })); // Use cookie for storing CSRF token

// Error handler for CSRF issues
app.use((err, req, res, next) => {
  if (err.code !== 'EBADCSRFTOKEN') return next(err);
  res.status(403).json({ message: 'Invalid CSRF token.' });
});

// Route to get CSRF token (e.g., for frontend to include in forms)
app.get('/api/csrf-token', (req, res) => {
  res.json({ csrfToken: req.csrfToken() });
});

// Example protected route for POST requests
app.post('/api/submit-data', (req, res) => {
  // req.body._csrf is automatically checked by csurf for POST requests
  res.json({ message: 'Data submitted securely with CSRF protection!' });
});

const PORT = process.env.PORT || 3002;
app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});