node.js - Remove csrf protecteion on API post calls -

i remove csrf express 3.0 application don't need there. use oauth validate clients. middleware whitelist api urls when using express.csrf()?

you can in 2 ways.

1.) create small middleware of own allow white list url patterns not blocked csrf like;

var express = require("express"); var expresscsrf = express.csrf(); var app = express.createserver();  var customcsrf = function (req, res, next) {     // assume exact match, can use regex match here   var csrfenabled = true;   var whitelist = new array("/pattern1/param1","/pattern2/param2","/pattern3/param3");   if (whitelist.indexof(req.path) != -1) {     csrfenabled = false;   }    if (csrfenabled) {     expresscsrf(req, res, next);   } else {     next();   } }  app.use(customcsrf); app.listen(3000); 

2.) use csrf middleware on controllers want enable. example, want use csrf check on profile save controller;

app.post("/profile/save", express.csrf(), function(req, res, next) {     // put code here });