search

expressjs / csurf

CSRF token middleware
MIT License
2.3k stars 216 forks source link

Added "ignoreRoutes" option to prevent CSRF from being checked on given routes #113

Closed anarqz closed 6 years ago

anarqz commented 7 years ago

Added option to send "ignoreRoutes" option during csurf init.

app.use(csrf({ ignoreRoutes: ['admin','api'] }));

The above snippet would prevent csurf from check the CSRF token on '/api' and '/admin' paths.

dougwilson commented 6 years ago

Hi @alcmoraes sorry I missed your PR here for all this time. I really don't know how I missed it, and I apologize. Thanks for your contribution, but this should be solveable by either following the readme and not using this module globally, or solutions like #64 . If there is a reason there is no possible way to do this without core modification, please provide an example and I'd be happy to reopen this PR :)