HTTP and Express middleware that compares the request's Origin header with a list of allowed origins, to protect against CSRF.
npm i csrf-simple-origin
const csrf = require('csrf-simple-origin');
const allowedOrigins = ['https://yoursite.example.com', 'http://anothersubdomain.yoursite.example.com'];
app.use(csrf(allowedOrigins));
Cross-site request forgery is a common problem on the web.
Mitigating these attacks used to mean that you had to pass a token to the client on every page, then check the token that they sent on every XHR request.
Most browsers now support the Origin header. This gives us a simple mechanism to verify XHR request and prevent CSRF. This middleware checks the Origin header against a list of allowed origins, rejecting requests from other (external) origins with a 400.
Read more at Understanding CSRF.
Creates the middleware.
Returns a function with a typical Express signature function(req, res, next) (compatible with Node HTTP server request handler) to handle the request.
Include this in your Express application with app.use() on your XHR routes
const middleware = csrf(allowedOrigins);
app.use(middleware);
Or in vanilla HTTP:
const middleware = csrf(allowedOrigins);
http.createServer((req, res) => middleware(req, res, () => {
// If we reach here, then CSRF `Origin` header has been verified!
doSomething();
});
options is an object with these defaults:
{
statusCode: 400,
statusMessage: 'Deceptive Routing',
failureHandler: null
}
Type: number
The HTTP code to respond if the request is rejected, i.e. if the request contain an Origin header which hasn't been whitelisted.
Type: string
The HTTP message to respond if the request is rejected, i.e. if the request contain an Origin header which hasn't been whitelisted.
Type: function(req, res, next)
If a handler is provided, this will be called instead of responding to the response.
const failureHandler = (req, res, next) => {
logIntrusion();
next();
};
app.use(csrf(allowedOrigins, {failureHandler}));
This code is licensed WTFPL, Beerware, or MIT, whichever you prefer. Use this code with or without modification, with or without attribution, with or without reproducing this license, for commercial purposes or any other purpose.