csrf-sync/lib/index.d.ts

A utility package to help implement stateful CSRF protection using the Synchroniser Token Pattern in express.

import { Request, Response, NextFunction } from 'express';
import { HttpError } from 'http-errors';

declare module "express-session" {
    interface SessionData {
        csrfToken?: CsrfSyncedToken;
    }
}
declare module "express-serve-static-core" {
    interface Request {
        csrfToken?: (overwrite?: boolean) => ReturnType<CsrfTokenGenerator>;
    }
}
type RequestMethod = "GET" | "HEAD" | "PATCH" | "PUT" | "POST" | "DELETE" | "CONNECT" | "OPTIONS" | "TRACE";
type CsrfSyncedToken = string | null | undefined;
type CsrfRequestToken = string | undefined;
type CsrfTokenStorer = (req: Request, token?: CsrfSyncedToken) => void;
type CsrfTokenRetriever = (req: Request) => CsrfSyncedToken;
type CsrfTokenGenerator = (req: Request, overwrite?: boolean) => string;
type CsrfTokenRevoker = (req: Request) => void;
type CsrfRequestValidator = (req: Request) => boolean;
type CsrfErrorConfig = {
    statusCode: number;
    message: string;
    code: string | undefined;
};
type CsrfErrorConfigOptions = Partial<CsrfErrorConfig>;
type CsrfSynchronisedProtection = (req: Request, res: Response, next: NextFunction) => void;
interface CsrfSyncOptions {
    ignoredMethods?: RequestMethod[];
    getTokenFromRequest?: CsrfTokenRetriever;
    getTokenFromState?: CsrfTokenRetriever;
    storeTokenInState?: CsrfTokenStorer;
    size?: number;
    errorConfig?: CsrfErrorConfigOptions;
    skipCsrfProtection?: (req: Request) => boolean;
}
interface CsrfSync {
    invalidCsrfTokenError: HttpError;
    csrfSynchronisedProtection: CsrfSynchronisedProtection;
    generateToken: CsrfTokenGenerator;
    getTokenFromRequest: CsrfTokenRetriever;
    getTokenFromState: CsrfTokenRetriever;
    isRequestValid: CsrfRequestValidator;
    storeTokenInState: CsrfTokenStorer;
    revokeToken: CsrfTokenRevoker;
}

declare const csrfSync: ({ ignoredMethods, getTokenFromRequest, getTokenFromState, storeTokenInState, size, errorConfig: { statusCode, message, code }, skipCsrfProtection, }?: CsrfSyncOptions) => CsrfSync;

export { type CsrfErrorConfig, type CsrfErrorConfigOptions, type CsrfRequestToken, type CsrfRequestValidator, type CsrfSync, type CsrfSyncOptions, type CsrfSyncedToken, type CsrfSynchronisedProtection, type CsrfTokenGenerator, type CsrfTokenRetriever, type CsrfTokenRevoker, type CsrfTokenStorer, type RequestMethod, csrfSync };