set csrf token on response for bypassed POST urls

krakenjs / lusca

Application security for express apps.

Other

1.79k stars 139 forks source link

set csrf token on response for bypassed POST urls #150

Open aravindsrivats opened 2 years ago

aravindsrivats commented 2 years ago

When a URL is added to be bypassed, CSRF is not set in the response which leads to subsequent POST requests throwing a 403. This change sets the CSRF token in res.locals before bypassing the validation.

Fixes - https://github.com/krakenjs/lusca/issues/142