primary logic behind csrf tokens


Logic behind CSRF token creation and verification. Read Understanding-CSRF for more information on CSRF. Use this module to create custom CSRF middleware and what not.

$ npm install csrf
var csrf = require('csrf')(options)
var secret = csrf.secretSync()
var token  = csrf.create(secret)
var valid  = csrf.verify(secret, token)
  • secretLength: 24 - the byte length of the secret key
  • saltLength: 8 - the string length of the salt
  • tokensize: (secret, salt) => token - a custom token creation function

Asynchronously create a new secret of length secretLength. If cb is not defined, a promise is returned. You don't have to use this.

csrf.secret().then(function (secret) {
csrf.secret(function (errsecret) {

Synchronous version of csrf.secret()

Create a CSRF token based on a secret. This is the token you pass to clients.

Check whether a CSRF token is valid based on a secret. If it's not valid, you should probably throw a 403 error.