Add option for verifying csrf token in certain types request only about csrf

[stephenmathieson]

I don't follow what you're asking for, but JSON APIs are just as vulnerable to CSRF attacks as APIs accepting multipart forms.

Closing for now. Reopen if you can provide more detail.

[sagan]

Sorry for my poor English. What I mean is, skip the CSRF token verification if the request Content-Type is not in [application/x-www-form-urlencoded, multipart/form-data, text/plain]. Because this kind of request can only be initiated from a same-origin XMLHttpRequest / fetch, which has no CSRF risks.

The code likes that:

if( [ 'application/x-www-form-urlencoded', 'multipart/form-data', 'text/plain' ].indexOf(ctx.request.type) == -1 )
  return next();

[stephenmathieson]

XMLHttpRequest and fetch absolutely have CSRF risks.