csrf-crypto.js
function verifyFormToken(formToken) {
		/*jshint validthis:true */
		checkSecure(this);

		// If we already cached this token, we know that it's valid.
		// If we validate two different tokens for the same request,
		// this won't incorrectly skip the second one.
		if (this.res._csrfFormToken && this.res._csrfFormToken === formToken)
			return true;

		this._csrfChecked = true;
		if (!formToken) return false;

		var cookieToken = getCookieToken(this.res);
		if (!cookieToken) return false;

		var parts = formToken.split('|');

		// If the token is invalid, reject it.
		if (parts.length !== 2)
			return false;

		var hasher = crypto.createHmac(options.algorithm, formKey);
		hasher.update(cookieToken);
		hasher.update("|");	// Don't confuse longer or shorter tokens
		hasher.update(parts[0]);

		// If the hash doesn't match, reject the token
		if (parts[1] !== hasher.digest('base64'))
			return false;

		// If we have a valid token, reuse it for this request
		// instead of generating a new one. (saves crypto ops)
		if (!this.res._csrfFormToken)
			this.res._csrfFormToken = formToken;

		return true;
	}
function verifyFormToken(formToken) {
		/*jshint validthis:true */
		checkSecure(this);

		// If we already cached this token, we know that it's valid.
		// If we validate two different tokens for the same request,
		// this won't incorrectly skip the second one.
		if (this.res._csrfFormToken && this.res._csrfFormToken === formToken)
			return true;

		this._csrfChecked = true;
		if (!formToken) return false;

		var cookieToken = getCookieToken(this.res);
		if (!cookieToken) return false;

		var parts = formToken.split('|');

		// If the token is invalid, reject it.
		if (parts.length !== 2)
			return false;

		var hasher = crypto.createHmac(options.algorithm, formKey);
		hasher.update(cookieToken);
		hasher.update("|");	// Don't confuse longer or shorter tokens
		hasher.update(parts[0]);

		// If the hash doesn't match, reject the token
		if (parts[1] !== hasher.digest('base64'))
			return false;

		// If we have a valid token, reuse it for this request
		// instead of generating a new one. (saves crypto ops)
		if (!this.res._csrfFormToken)
			this.res._csrfFormToken = formToken;

		return true;
	}
function verifyFormToken ( formToken ) { /*jshint validthis:true */ checkSecure ( this ) ; // If we already cached this token, we know that it's valid. // If we validate two different tokens for the same request, // this won't incorrectly skip the second one. if ( this . res . _csrfFormToken && this . res . _csrfFormToken === formToken ) return true ; this . _csrfChecked = true ; if ( ! formToken ) return false ; var cookieToken = getCookieToken ( this . res ) ; if ( ! cookieToken ) return false ; var parts = formToken . split ( '|' ) ; // If the token is invalid, reject it. if ( parts . length !== 2 ) return false ; var hasher = crypto . createHmac ( options . algorithm , formKey ) ; hasher . update ( cookieToken ) ; hasher . update ( "|" ) ; // Don't confuse longer or shorter tokens hasher . update ( parts [ 0 ] ) ; // If the hash doesn't match, reject the token if ( parts [ 1 ] !== hasher . digest ( 'base64' ) ) return false ; // If we have a valid token, reuse it for this request // instead of generating a new one. (saves crypto ops) if ( ! this . res . _csrfFormToken ) this . res . _csrfFormToken = formToken ; return true ; }
Verifies a form token submitted with the current request.
This function must be called on the request object.

@returns {Boolean} True if the form token matches the cookie in the request.
Verifies a form token submitted with the current request . This function must be called on the request object .