# expressjs/csurf

CSRF token middleware

Repository: https://github.com/expressjs/csurf
Canonical: https://ross.abutalabs.com/products/csurf
License: MIT
License Family: permissive
Topics: javascript, nodejs, middleware, expressjs, csrf
Archived: true
Last push: 2025-05-14T13:34:34+00:00

## Health v2 (maintenance only)
Score: 10/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 21, release rhythm 8, longevity 100
- inputs: {"age_days": 4564, "days_push": 476, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: archived
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2307, forks 218 (observed 2026-08-28T04:06:35.797618+00:00)

## What it is
csurf is Node.js CSRF protection middleware for Express that creates and validates CSRF tokens via session or cookie-based storage. The repository is archived and no longer actively maintained.

## Use cases
- protect express forms from csrf attacks
- add csrf tokens to nodejs web app
- validate csrf token on state-changing requests
- double submit cookie csrf protection
- csrf middleware for express session

## When to choose
- you maintain a legacy Express app already using csurf
- you need the classic session-based CSRF token pattern

## When to avoid
- starting a new project - the repo is archived and unmaintained
- you need security fixes or ongoing support
- you use a non-Express framework

## Facets
- artifact type: library
- maturity: abandoned
- function: middleware, security, auth
- domain: security, web-development, backend
- platform: -
- tags: csrf, express, csrf-protection, double-submit-cookie, archived, nodejs

## Member repositories
- expressjs/csurf (main) score 10

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:06:35.797618+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:39:39.154225+00:00, confidence not recorded.
  - readme: https://github.com/expressjs/csurf (fetched 2026-08-28T04:06:35.797618+00:00, sha 70b9f5394335)
  - registry_npm: https://registry.npmjs.org/csurf (fetched 2026-08-29T10:20:19.377033+00:00, sha 5facb05d6b04)
- Data as of 2026-08-30T08:39:29.467469+00:00.