Rule Definition
CSRF takes advantage the fact that most web apps allow attackers to predict all the details of a particular action. Because browsers send credentials like session cookies automatically, attackers can create malicious web pages which generate forged requests that are indistinguishable from legitimate ones.

Remediation
Ensure you have enable CSRF module in Express and pass the information to the templates

Violation Code Sample

var express = require('express'); 
var app = express(); 

app.listen(3000);

Fixed Code Sample

// default csrf library 

var express = require('express'); 
var app = express(); 
app.use(csrf()); 

app.use(function (req, res, next) { 
  res.cookie('XSRF-TOKEN', req.csrfToken()); 
  res.locals.csrftoken = req.csrfToken(); 
  next(); 
}); 
app.use(app.router); 

app.listen(3000); 

// or example with csurf library 

var csrf = require('csurf') 
// setup route middlewares 
var csrfProtection = csrf({ cookie: true }) 

// create express app 
var app = express() 

app.get('/form', csrfProtection, function (req, res) { 
  // pass the csrfToken to the view 
  res.render('send', { csrfToken: req.csrfToken() }) 
}) 

// or example with express-csrf library 

var express = require('express'), 
    csrf = require('express-csrf'); 

app = express.createServer(); 

app.dynamicHelpers({ 
    csrf: csrf.token 
}); 

app.use(express.cookieParser()); 
app.use(express.bodyParser()); 
app.use(express.session()); 
app.use(csrf.check()); 

app.listen(3000);

https://expressjs.com/en/advanced/best-practice-security.html https://www.owasp.org/index.php/Top_10_2013-A8-Cross-Site_Request_Forgery_(CSRF) https://www.owasp.org/index.php/Top_10_2017-A8-Cross-Site_Request_Forgery_(CSRF) OMG CISQ ASCSM-CWE-079