CSRF tokens for koa.
npm install koa-csrf
To install, do:
require('koa-csrf')(app, options)All options are passed to csrf-tokens.
Lazily creates a CSRF token. CSRF tokens change on every request.
app.use(function* () {
this.render({
csrf: this.csrf
})
})Check the CSRF token of a request with an optional body. Will throw if the CSRF token does not exist or is not valid.
app.use(function* () {
var body = yield parse(this) // co-body or something
try {
this.assertCSRF(body)
} catch (err) {
this.status = 403
this.body = {
message: 'This CSRF token is invalid!'
}
return
}
})koa-csrf also provide a koa middleware, it is similar to connect-csrf.
in most situation, you only need:
var koa = require('koa')
var csrf = require('koa-csrf')
var session = require('koa-session')
var app = koa()
app.keys = ['session secret']
app.use(session())
csrf(app)
app.use(csrf.middleware)
app.use(function* () {
if (this.method === 'GET') {
this.body = this.csrf
} else if (this.method === 'POST') {
this.status = 204
}
})