lib/middleware.js
function (options) {
    var ignore = options.ignore || [],
        csrf = csurf(options),
        always = {OPTIONS: 1, GET: 1, HEAD: 1};

    return function (req, res, next) {
      if (always[req.method]) {
        return csrf(req, res, next);
      } else {
        var url = parse(req.url);
        var skipCSRF = false;
        ignore.forEach(function(matcher) {
          if (typeof matcher === 'string') {
            if (matcher === url.pathname) {
              skipCSRF = true;
            }
          } else {
            // regular expression matcher
            if (url.pathname.match(matcher)) {
              skipCSRF = true;
            }
          }
        });

        if (skipCSRF) {
          next();
        } else {
          return csrf(req, res, next);
        }
      }
    };
  }
function (options) {
    var ignore = options.ignore || [],
        csrf = csurf(options),
        always = {OPTIONS: 1, GET: 1, HEAD: 1};

    return function (req, res, next) {
      if (always[req.method]) {
        return csrf(req, res, next);
      } else {
        var url = parse(req.url);
        var skipCSRF = false;
        ignore.forEach(function(matcher) {
          if (typeof matcher === 'string') {
            if (matcher === url.pathname) {
              skipCSRF = true;
            }
          } else {
            // regular expression matcher
            if (url.pathname.match(matcher)) {
              skipCSRF = true;
            }
          }
        });

        if (skipCSRF) {
          next();
        } else {
          return csrf(req, res, next);
        }
      }
    };
  }
function ( options ) { var ignore = options . ignore || [ ] , csrf = csurf ( options ) , always = { OPTIONS : 1 , GET : 1 , HEAD : 1 } ; return function ( req , res , next ) { if ( always [ req . method ] ) { return csrf ( req , res , next ) ; } else { var url = parse ( req . url ) ; var skipCSRF = false ; ignore . forEach ( function ( matcher ) { if ( typeof matcher === 'string' ) { if ( matcher === url . pathname ) { skipCSRF = true ; } } else { // regular expression matcher if ( url . pathname . match ( matcher ) ) { skipCSRF = true ; } } } ) ; if ( skipCSRF ) { next ( ) ; } else { return csrf ( req , res , next ) ; } } } ; }
monkey patch for express' own csrf method, so we can ignore specific url patterns
monkey patch for express own csrf method so we can ignore specific url patterns