{
  "name": "csurf",
  "description": "CSRF token middleware",
  "version": "1.2.1",
  "author": {
    "name": "Jonathan Ong",
    "email": "me@jongleberry.com",
    "url": "http://jongleberry.com"
  },
  "license": "MIT",
  "repository": {
    "type": "git",
    "url": "git://github.com/expressjs/csurf"
  },
  "dependencies": {
    "csrf-tokens": "~1.0.2"
  },
  "devDependencies": {
    "cookie-session": "*",
    "body-parser": "*",
    "cookie-parser": "*",
    "mocha": ">= 1.17.0 < 2",
    "should": ">= 3.0.0 < 4",
    "supertest": "*",
    "connect": "*"
  },
  "engines": {
    "node": ">= 0.8.0"
  },
  "scripts": {
    "test": "make test"
  },
  "readme": "# csurf [![Build Status](https://travis-ci.org/expressjs/csurf.svg?branch=master)](https://travis-ci.org/expressjs/csurf) [![NPM Version](https://badge.fury.io/js/csurf.svg)](https://badge.fury.io/js/csurf)\n\nNode.js [CSRF](https://en.wikipedia.org/wiki/Cross-site_request_forgery) protection middleware.\n\nRequires either a session middleware or [cookie-parser](https://github.com/expressjs/cookie-parser) to be initialized first.\n- [session](https://github.com/expressjs/session)\n- [cookie-session](https://github.com/expressjs/cookie-session)\n\n### Install\n\n```sh\n$ npm install csurf\n```\n\n## API\n\n```js\nvar csrf = require('csurf')\n```\n\n### csrf(options)\n\nThis middleware adds a `req.csrfToken()` function to make a token which should be added to requests which mutate state, within a hidden form field, query-string etc. This token is validated against the visitor's session or csrf cookie.\n\n#### Options\n\n- `value` a function accepting the request, returning the token.\n  - The default function checks four possible token locations:\n    - `_csrf` parameter in `req.body` generated by the `body-parser` middleware.\n    - `_csrf` parameter in `req.query` generated by `query()`.\n    - `x-csrf-token` and `x-xsrf-token` header fields.\n- `cookie` set to a truthy value to enable cookie-based instead of session-based csrf secret storage.\n  - If `cookie` is an object, these options can be configured, otherwise defaults are used:\n    - `key` the name of the cookie to use (defaults to `_csrf`) to store the csrf secret\n    - any other [res.cookie](http://expressjs.com/4x/api.html#res.cookie) options can be set\n\n### req.csrfToken()\n\nLazy-loads the token associated with the request.\n\n## Example\n\n```js\nvar express = require('express')\nvar csrf    = require('csurf')\n\nvar app = express()\napp.use(csrf())\n```\n\n## License\n\n[MIT](LICENSE)\n",
  "readmeFilename": "README.md",
  "bugs": {
    "url": "https://github.com/expressjs/csurf/issues"
  },
  "homepage": "https://github.com/expressjs/csurf",
  "_id": "csurf@1.2.1",
  "_shasum": "3928fa237592ed5824a7c221d8581bf356a9da76",
  "_from": "csurf@1.2.1",
  "_resolved": "https://registry.npmjs.org/csurf/-/csurf-1.2.1.tgz"
}
