Csrf-validator NPM

csrf-validator

A CSRF validator library for Node.js and Nestjs.

Using this library will let you directly configure CSRF Validator for your app without a cookie-parser as it is already built in.

You will have an option to manually add cookie parser as well.

Installation

This package is published over npm registry.

$ npm install csrf-validator

Implementation

There are two types of implementations available. 1. Without configuring cookie-parser and cookie-session 2. With configuring cookie-parser and cookie-session manually

1. Without configuring `cookie-parser` and `cookie-session`

In this method, you don't have to configure cookie-parser and cookie-session manually, it will automatically get configured

Express.js

var express = require('express');

var app = express();

CSRFValidator.instance(
        {
          tokenSecretKey: 'A secret key for encrypting csrf token',
          ignoredMethods: [],
          ignoredRoutes: ['/login'],
          entryPointRoutes: ['/login'],
          cookieKey: 'Optional - Custom csrf cookie key',
          cookieSecretKey: 'Cookie secret key for cookie-parser',
          cookieSessionKeys: [
            'First session key for cookie-session',
            'Second session key for cookie-session'
          ]
        }
).configureApp(app);

NestJS

import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);

  CSRFValidator.instance(
          {
            tokenSecretKey: 'A secret key for encrypting csrf token',
            ignoredMethods: [],
            ignoredRoutes: ['/login'],
            entryPointRoutes: ['/login'],
            cookieKey: 'Optional - Custom csrf cookie key',
            cookieSecretKey: 'Cookie secret key for cookie-parser',
            cookieSessionKeys: [
              'First session key for cookie-session',
              'Second session key for cookie-session'
            ]
          }
  ).configureApp(app);
}

2. With configuring `cookie-parser` and `cookie-session` manually

In this method, you have to configure cookie-parser and cookie-session manually

Express.js

var express = require('express');
var cookieSession = require('cookie-session');
var cookieParser = require('cookie-parser');

var app = express();
app.use(cookieParser('Cookie secret key for cookie-parser'));
app.use(cookieSession({
  keys: [
    'First session key for cookie-session',
    'Second session key for cookie-session'
  ]
}));

app.use(CSRFValidator.instance({
  tokenSecretKey: 'A secret key for encrypting csrf token',
  ignoredMethods: [],
  ignoredRoutes: ['/login'],
  entryPointRoutes: ['/login'],
  cookieKey: 'Optional - Custom csrf cookie key'
}).configure());

NestJS

import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';
import * as cookieSession from 'cookie-session';
import * as cookieParser from 'cookie-parser';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  app.use(cookieParser('Cookie secret key for cookie-parser'));
  app.use(cookieSession({
    keys: [
      'First session key for cookie-session',
      'Second session key for cookie-session'
    ]
  }));

  app.use(CSRFValidator.instance({
    tokenSecretKey: 'A secret key for encrypting csrf token',
    ignoredMethods: [],
    ignoredRoutes: ['/login'],
    entryPointRoutes: ['/login'],
    cookieKey: 'Optional - Custom csrf cookie key'
  }).configure());
}

Configuration

Just like demonstrated above, you have to call either CSRFValidator.instance().configreApp(app) or app.use(CSRFValidator.instance().configreApp()) with CSRFValidatorOptions to configure.

CSRFValidatorOptions

Field	Usage	Example
tokenSecretKey	This is a secret key used to encrypt CSRF tokens	`'6e655c9df6374cfa8a2d77c5f5d7d'`
ignoredMethods	Array of methods, those will be ignored at the time of CSRF token verification. But still won't set any token in response.	`['GET', 'POST']`
ignoredRoutes	Array of routes, those will be ignored at the time of CSRF token verification. But still won't set any token in response.	`['/login', '/user']`
entryPointRoutes	Array of routes, if the routes ignored like above, you still need a starting point. Setting entry point routes will treat those routes to set the CSRF token in response.	`['/login']`
cookieKey	This is an optional filed. You can customize the token key name using this field	`'custom-csrf-cookie'`
cookieSecretKey	This is a secret key to setup `cookie-parser`	`'5edc865af772d214c6d9893b57a51'`
cookieSessionKeys	This is an array of secret keys to setup `cookie-session`	`['7f6cb6e3c9cefd7b2c6b76826516d', 'ff675b9dcb1d6324d96789ef939b1']`