'How to set csrfToken with express-session?

I'm using express-session and connect pg simple for my session and store management like so:

app.use(
  session({
    secret: process.env.SECRET,
    resave: false,
    saveUninitialized: false,
    cookie: {
      maxAge: 604800,
      secure: isProduction ? true : false,
      sameSite: "lax",
    },
    store: new pgSession({
      pool: db,
      createTableIfMissing: true,
    }),
  })
);

I'm also implementing passport.js and everything works well but when I implement csurf middleware like so,

// CSURF
const csurf = require("csurf");
const csrfMiddleware = csurf();

app.use(csrfMiddleware);

// Register
usersRouter.get("/register", checkAuthenticated, (req, res) => {
  res.render("register", { csrfToken: req.csrfToken() });
});

// Login
usersRouter.get("/login", checkAuthenticated, (req, res) => {
  res.render("login", { csrfToken: req.csrfToken() });
});

And in my forms:

<input type="hidden" name="_csrf" value="<%= csrfToken %>" />

I'm getting errors saying that csrfToken is not defined in my view page.

There isn't much documentation about how to exactly use csrfToken with express-session and storing it in a session or maybe even in a store (connect pg simple), so is there a way I can solve these problems?



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source