csrf-validator

CSRF Validator for Node.js

Usage no npm install needed!

<script type="module">
  import csrfValidator from 'https://cdn.skypack.dev/csrf-validator';
</script>

README

csrf-validator

NPM Version NPM Downloads Node.js Version

A CSRF validator library for Node.js and Nestjs.

Using this library will let you directly configure CSRF Validator for your app without a cookie-parser as it is already built in.

You will have an option to manually add cookie parser as well.

Installation

This package is published over npm registry.

$ npm install csrf-validator

Implementation

There are two types of implementations available.

  1. Without configuring cookie-parser and cookie-session
  2. With configuring cookie-parser and cookie-session manually

1. Without configuring cookie-parser and cookie-session

In this method, you don't have to configure cookie-parser and cookie-session manually, it will automatically get configured

Express.js
var express = require('express');

var app = express();

CSRFValidator.instance(
        {
          tokenSecretKey: 'A secret key for encrypting csrf token',
          ignoredMethods: [],
          ignoredRoutes: ['/login'],
          entryPointRoutes: ['/login'],
          cookieKey: 'Optional - Custom csrf cookie key',
          cookieSecretKey: 'Cookie secret key for cookie-parser',
          cookieSessionKeys: [
            'First session key for cookie-session',
            'Second session key for cookie-session'
          ]
        }
).configureApp(app);
NestJS
import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);

  CSRFValidator.instance(
          {
            tokenSecretKey: 'A secret key for encrypting csrf token',
            ignoredMethods: [],
            ignoredRoutes: ['/login'],
            entryPointRoutes: ['/login'],
            cookieKey: 'Optional - Custom csrf cookie key',
            cookieSecretKey: 'Cookie secret key for cookie-parser',
            cookieSessionKeys: [
              'First session key for cookie-session',
              'Second session key for cookie-session'
            ]
          }
  ).configureApp(app);
}

2. With configuring cookie-parser and cookie-session manually

In this method, you have to configure cookie-parser and cookie-session manually

Express.js
var express = require('express');
var cookieSession = require('cookie-session');
var cookieParser = require('cookie-parser');

var app = express();
app.use(cookieParser('Cookie secret key for cookie-parser'));
app.use(cookieSession({
  keys: [
    'First session key for cookie-session',
    'Second session key for cookie-session'
  ]
}));

app.use(CSRFValidator.instance({
  tokenSecretKey: 'A secret key for encrypting csrf token',
  ignoredMethods: [],
  ignoredRoutes: ['/login'],
  entryPointRoutes: ['/login'],
  cookieKey: 'Optional - Custom csrf cookie key'
}).configure());
NestJS
import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';
import * as cookieSession from 'cookie-session';
import * as cookieParser from 'cookie-parser';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  app.use(cookieParser('Cookie secret key for cookie-parser'));
  app.use(cookieSession({
    keys: [
      'First session key for cookie-session',
      'Second session key for cookie-session'
    ]
  }));

  app.use(CSRFValidator.instance({
    tokenSecretKey: 'A secret key for encrypting csrf token',
    ignoredMethods: [],
    ignoredRoutes: ['/login'],
    entryPointRoutes: ['/login'],
    cookieKey: 'Optional - Custom csrf cookie key'
  }).configure());
}

Configuration

Just like demonstrated above, you have to call either CSRFValidator.instance().configreApp(app) or app.use(CSRFValidator.instance().configreApp()) with CSRFValidatorOptions to configure.

CSRFValidatorOptions

Field Usage Example
tokenSecretKey This is a secret key used to encrypt CSRF tokens '6e655c9df6374cfa8a2d77c5f5d7d'
ignoredMethods Array of methods, those will be ignored at the time of CSRF token verification. But still won't set any token in response. ['GET', 'POST']
ignoredRoutes Array of routes, those will be ignored at the time of CSRF token verification. But still won't set any token in response. ['/login', '/user']
entryPointRoutes Array of routes, if the routes ignored like above, you still need a starting point. Setting entry point routes will treat those routes to set the CSRF token in response. ['/login']
cookieKey This is an optional filed. You can customize the token key name using this field 'custom-csrf-cookie'
cookieSecretKey This is a secret key to setup cookie-parser '5edc865af772d214c6d9893b57a51'
cookieSessionKeys This is an array of secret keys to setup cookie-session ['7f6cb6e3c9cefd7b2c6b76826516d', 'ff675b9dcb1d6324d96789ef939b1']

License

MIT