title: Using CSRF in NodeJS
body: <p><br/>I am trying to use csrf in my NodeJS application. 
  You can see the code below. When I run this code I am getting "TypeError: req.csrfToken is not a function" error.
  <br/><br/>I want to create csrf token for all requests and want to check csrf tokens in ajax calls. As I said I can not create csrf token, I am getting error. Also how can I check csrf token in ajax calls?
  <br/><br/>Can you help me ?
  <br/>Thanks</p>
  
  <p>Server Side:</p>
  
  <pre><code>var express = require('express');
  var cookieParser = require('cookie-parser');
  var session = require('express-session');
  var csrf = require('csurf');
  var bodyParser = require('body-parser');
  
  /*this line commented*/
  //var csrfProtection = csrf({ cookie: false });
  var app = express();
  
  // view engine setup
  app.set('views', path.join(__dirname, 'views'));
  app.set('view engine', 'jade');
  
  var parseForm = bodyParser.urlencoded({ extended: false });
  app.use(cookieParser());
  
  /*this line added*/
  app.use(csrf({ cookie: false }));
  
  app.use(session({
      genid: function (req) {
          return "lkgktktgjknvfndkj-dfgjnkdfkjgn-dfgdfg";
      },
      name: "mySecret",
      resave: false, // don't save session if unmodified
      saveUninitialized: false, // don't create session until something stored
      secret: 'thisIsASecret'
  }));
  
  app.use(express.static(path.join(__dirname, 'public')));
  
  app.use(function (req, res, next) {
      res.locals.csrfToken = req.csrfToken();
  
      next();
  });
  
  app.get('/', /*csrfProtection,*/ function (req, res) {
      res.render('index')
  });
  
  app.post('/process', parseForm, /*csrfProtection,*/ function (req, res) {
      res.send('data is being processed')
  });
  </code></pre>
  
  <p>Index.jade</p>
  
  <pre><code>meta(name="csrf-token", content="#{csrfToken}")
  block content
      input(type="hidden" name="_csrf" value="#{csrfToken}")
  
      |Favorite color: &lt;input type="text" name="favoriteColor"&gt;
      button(type="submit" id="sbmt") Submit
  
      script(src= "/javascripts/jquery-2.2.1.js")
  
      script.
          $.ajaxPrefilter(function(options, originalOptions, jqXHR) {
            var token;
            if (!options.crossDomain) {
              token = $('meta[name="csrf-token"]').attr('content');
              if (token) {
                  return jqXHR.setRequestHeader('X-CSRF-Token', token);
              }
            }
          });
  
          $("#sbmt").click(function (e) {
              e.preventDefault();
              $.post(
                  "/process",
                  {
                      //text: text,
                      _csrf : $('meta[name="csrf-token"]').attr('content')
                  }, function (data) {
                      console.log(data);
                  });
          });
  </code></pre>