Disable CSRF checking during tests

[expressjs]

Disable CSRF checking during tests

[dougwilson]

So your getting the token and submitting it during test would work if you also submitting the cookie as well. Without the cookie, the session is not known.

This module did used to disable checks when under test, but that was found to be a security vulunerability by the secuirty community, because they say people can end up where they have a server running with the checks off and not realize, so we had to remove the feature. If you do want that feature back, you'll have to add it back in user-land, like the following:

app.use(
  process.end.NODE_ENV === 'test' ?
    csurf({ ignoreMethods: ['GET', 'HEAD', 'OPTIONS', 'POST', 'PUT' /* etc */] })
    csurf()
)

I hope this helps!