expressjs/csurf — pull request #37 by arcanis (2014-11-02 18:21:50+00:00)
Title: Splits token generation and validation

I'm currently using this branch one a personal project and it seems to work fine. Tests are (mostly) passing, check the following for more infos.

**Additions**
- `csurf.generator()` is a middleware adding the following to the request object :
- `csrfToken()` returns the current session token (as before)
- `checkCsrf()` returns a boolean : true if the csrf token is correctly set (**new**)
- `csurf.validator()` is a middleware automatically calling the `checkCsrf()` method from the request object, and returning a 403 error if the token does not match.

**Changes**
- One of the test expected every requests to crash when there was `!cookie && !req.session` (bad configuration settings), even when the request method was supposed to be ignored. I fixed it. The un-fix is pretty simple, so tell me if you want to revert it, but I think it should be mostly safe, since it's a bit impossible to run a website with a bad configuration anyway.

**WIP**
- One test is failing (*csurf should error without cookieParser secret and signed cookie storage*), because validating a csrf does not cause one to be created. I think it is correct too, but your call.