Question

In ruby one can do something like <%= form_tag(:action => '/submit') do %> ... <% end %> to get a form including CSRF tokens.

Is there an existing function in node and how is it implemented?

Answer 1

You can use caolan-forms plugin for node.js. After that install express-csrf plugin.

Then you can merge these two, something like:

// initializing express
var express = require('express'),

// initializing express-csrf   
csrf = require('express-csrf');

app = express.createServer();

app.dynamicHelpers({
    csrf: csrf.token
});

var forms = require('forms'),
    fields = forms.fields,
    validators = forms.validators;

var reg_form = forms.create({
    username: fields.string({required: true, id: csrf, name: csrf}),
});

// finally render the form
reg_form.toHTML();

It would produce:

<div class="field required">
   <label for="id_username">Username</label>
   <input type="text" name="[csrf-value]" id="[csrf-value]" value="test" />
</div>

Note: The caolan-forms’ author wrote:

You’ll notice you have to provide your own form tags and submit button, its more flexible this way 😉

Edit

Since express-csrf is depriciated, instead use connect bundle and follow this simple example. Eventually, you would be able to integrate it with caolan-forms like:

var reg_form = forms.create({
     '_csrf':fields.hidden({value: 'req.session._csrf'}),
      ...
})