Implementing CSRF Protection in a Node.js/Express Application

const express = require('express');
const cookieParser = require('cookie-parser');
const session = require('express-session');
const csurf = require('csurf');
const bodyParser = require('body-parser');

const app = express();

// Middleware setup
app.use(cookieParser());
app.use(session({
  secret: 'super-secret-session-key', // Change this to a strong, random key in production
  resave: false,
  saveUninitialized: true,
  cookie: { secure: process.env.NODE_ENV === 'production' }, // Use secure cookies in production
}));

// csurf middleware
// Requires cookie-parser and express-session to be set up first
const csrfProtection = csurf({ cookie: true });

// Body parser for POST requests
app.use(bodyParser.urlencoded({ extended: false }));

// Route for displaying a form with a CSRF token
app.get('/form', csrfProtection, (req, res) => {
  res.send(`
    <h1>Submit Data</h1>
    <form action="/process" method="POST">
      <input type="text" name="item" placeholder="Enter item">
      <input type="hidden" name="_csrf" value="${req.csrfToken()}">
      <button type="submit">Submit</button>
    </form>
  `);
});

// Route for processing the form submission
app.post('/process', csrfProtection, (req, res) => {
  console.log('Received item:', req.body.item);
  res.send('Data processed successfully!');
});

// Error handling for CSRF issues
app.use((err, req, res, next) => {
  if (err.code === 'EBADCSRFTOKEN') {
    res.status(403).send('Invalid CSRF token.');
  } else {
    next(err);
  }
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});