Adds middleware for Cross-Site Request Forgery (CSRF)

[eduardolundgren]

No description provided.

[eduardolundgren]

It's a tricky decision to support this by default since it's only recommended to have CSRF protection for requests that always comes from inside the same app, if the api is public or can be consumed by a third-party it's not possible to enable it.

See https://www.npmjs.com/package/csurf
See https://blog.risingstack.com/node-js-security-checklist

Therefore, you can plug it yourself on your magnet route:

import csrf from 'csurf';

let csrfProtection = csrf({ cookie: true });

export default (app) => {
   app.post('/internal', csrfProtection, (req, res) => {...});
};