title: How do I generate CSRF tokens in Express?
body: <p>newbie. 
  I'm using ExpressJS/Node. Here's my config stuff:</p>
  
  <pre><code>var express = require('express'),
  app = express.createServer(),
  jade=require('jade');
  // Configuration
  app.configure(function(){
  app.set('views', __dirname + '/views');
  app.use(express.logger());
  app.use(express.cookieParser());
  app.use(express.session({ secret: "secretive secret" }));
  app.set('view engine', 'jade');
  app.use(express.bodyParser());
  app.use(express.methodOverride());
  app.use(require('stylus').middleware({ src: __dirname + '/public' }));
  app.use(app.router);
  app.use(express.static(__dirname + '/public'));
  app.use(express.csrf());
  </code></pre>
  
  <p>I found csrf.js in Express directories, and see that it should be generated and assigned to req.body._csrf, but I'm not sure how to access it.</p>
  
  <p>Here's the csrf.js code</p>
  
  <pre><code>module.exports = function csrf(options) {
  var options = options || {}
  , value = options.value || defaultValue;
  
  return function(req, res, next){
  // generate CSRF token
  var token = req.session._csrf || (req.session._csrf = utils.uid(24));
  
  // ignore GET (for now)
  if ('GET' == req.method) return next();
  
  // determine value
  var val = value(req);
  
  // check
  if (val != token) return utils.forbidden(res);
  
  next();
  }
  }; 
  </code></pre>
  
  <p>Help? Thanks!</p>