@julian Thanks this did the trick!
I used it like this in my client side code:
<input id="csrfToken" type="hidden" name="_csrf" value="" />
...
$(window).on('action:ajaxify.end', function(data) {
require(['csrf'], function(csrf) {
var csrfToken = csrf.get();
console.log('obtained csrfToken: ' + csrfToken);
$('#csrfToken').val(csrfToken);
});
});
@yariplus I'm not really sure about your specific question. I have a feeling that the csrf tokens are generated based on a csrfSecret that is stored in the user's session. You could check that the session has this loaded on the server side with this:
var util = require('util');
console.log('user session' + util.inspect(req));
For me, this results in:
user session: { cookie:
{ path: '/',
_expires: Sun Nov 22 2015 09:52:23 GMT-0800 (PST),
originalMaxAge: 1209599988,
httpOnly: true },
csrfSecret: '70lFS_InV_56D1gvV9TDKgJX',
flash: {},
passport: { user: 1 } }
