# express-secure

> Keep express secure with CSRF protection

Latest version **2.0.0** (published 2017-01-09) · ISC license · 0 weekly downloads

## Install

```sh
npm install express-secure
pnpm add express-secure
yarn add express-secure
bun add express-secure
```

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 2.0.0 |
| Published | 2017-01-09 |
| First published | 2017-01-08 |
| Weekly downloads | 0 |
| License | ISC |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 1 |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Author | Liam Davies |
| Maintainers | immortal |

## Links

- npm: https://www.npmjs.com/package/express-secure
- Repository: https://github.com/liam056/express-secure
- Homepage: https://github.com/liam056/express-secure#readme
- Issues: https://github.com/liam056/express-secure/issues
- npm.io page: https://npm.io/package/express-secure

## Dependencies (1)

- [jwt-simple](https://npm.io/package/jwt-simple.md) ^0.5.1

## Recent versions

- 2.0.0 (latest) — 2017-01-09
- 1.0.0 — 2017-01-08

## README

# express-secure

Keep your express application secure from CSRF attacks. It uses a combination of HTTP only JWT and a CSRF token stored in the session.

Used with express as middleware.

## Example

```javascript
var express = require('express');
var expresssecure = require('express-secure');

var app = express();

app.use(/* session */);

app.use(expresssecure({
  secret: 'thisisasecret',
  ignore: [
    '/login'
  ],
  error: function(req,res,next) {
    res.send(JSON.stringify({
      success: false,
      reason: "Access Denied"
    }));
    res.end();
  }
}));

/*
 * Ignored route
 */
app.post('/login', function(req, res) {
  /*
   * Verify Login
   */

   // Set the httpOnly cookie containing the JWT
   res.setJwtCookie((err) {
     req.getCsrfToken((err, csrf) {
       // send back response including csrf
     });
   });
});

/*
 * Secure routes
 */
app.post('/users', /* Get Users */);

```

---
_Source: https://npm.io/package/express-secure · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._