Express CSRF Protection with Double Submit

const crypto = require("crypto");
const cookieParser = require("cookie-parser");

app.use(cookieParser());

app.use((req, res, next) => {
  if (!req.cookies.csrf_token) {
    res.cookie("csrf_token", crypto.randomBytes(32).toString("hex"), { sameSite: "strict" });
  }
  next();
});

function verifyCsrf(req, res, next) {
  const cookie = req.cookies.csrf_token;
  const header = req.headers["x-csrf-token"];
  if (!cookie || cookie !== header) return res.status(403).json({ error: "CSRF mismatch" });
  next();
}

app.post("/api/donate", verifyCsrf, (req, res) => res.json({ ok: true }));