text: function defaultValue(e){return e.body&&e.body._csrf||e.query&&e.query._csrf||e.headers["csrf-token"]||e.headers["xsrf-token"]||e.headers["x-csrf-token"]||e.headers["x-xsrf-token"]}function getCookieOptions(e){if(e!==!0&&"object"!=typeof e)return void 0;var n={key:"_csrf",path:"/"};if(e&&"object"==typeof e)for(var t in e){var r=e[t];void 0!==r&&(n[t]=r)}return n}function getIgnoredMethods(e){for(var n=Object.create(null),t=0;t<e.length;t++){var r=e[t].toUpperCase();n[r]=!0}return n}function getsecret(e,n,t){var r;if(t){var i=t.signed?"signedCookies":"cookies";r=e[i][t.key]}else{if(!e[n])throw new Error("misconfigured csrf");r=e[n].csrfSecret}return r}function setcookie(e,n,t,r){var i=Cookie.serialize(n,t,r),a=e.getHeader("set-cookie")||[],o=Array.isArray(a)?a.concat(i):Array.isArray(i)?[a].concat(i):[a,i];e.setHeader("set-cookie",o)}function setsecret(e,n,t,r,i){if(i){if(i.signed){var a=e.secret;if(!a)throw new Error('cookieParser("secret") required for signed cookies');r="s:"+sign(r,a)}setcookie(n,i.key,r,i)}else{if(!e[t])throw new Error("misconfigured csrf");e[t].csrfSecret=r}}function verifytoken(e,n,t,r){if(!n.verify(t,r))throw createError(403,"invalid csrf token",{code:"EBADCSRFTOKEN"})}var Cookie=require("cookie"),createError=require("http-errors"),sign=require("cookie-signature").sign,Tokens=require("csrf");module.exports=function(e){e=e||{};var n=getCookieOptions(e.cookie),t=e.sessionKey||"session",r=e.value||defaultValue,i=new Tokens(e),a=void 0===e.ignoreMethods?["GET","HEAD","OPTIONS"]:e.ignoreMethods;if(!Array.isArray(a))throw new TypeError("option ignoreMethods must be an array");var o=getIgnoredMethods(a);return function(e,a,s){var l,u=getsecret(e,t,n);e.csrfToken=function(){var r=n?u:getsecret(e,t,n);return l&&r===u?l:(void 0===r&&(r=i.secretSync(),setsecret(e,a,t,r,n)),u=r,l=i.create(u))},u||(u=i.secretSync(),setsecret(e,a,t,u,n)),o[e.method]||verifytoken(e,i,u,r(e)),s()}};