Use session instead of cookies.

app.js

@@ -7,7 +7,6 @@ const passport = require('./services/passport');
 const session = require('express-session');
 const RedisStore = require('connect-redis')(session);
 const redis = require('./services/redis');
-const cookieParser = require('cookie-parser');
 
 const app = express();
 
@@ -65,11 +64,6 @@ if (app.get('env') === 'production') {
 
 app.use(session(session_opts));
 
-//==============================================================================
-// AUTHENTICATION TOKEN MIDDLEWARE
-//==============================================================================
-app.use(cookieParser());
-
 //==============================================================================
 // PASSPORT MIDDLEWARE
 //==============================================================================

package.json

@@ -90,7 +90,6 @@
     "chai": "^3.5.0",
     "chai-http": "^3.0.0",
     "copy-webpack-plugin": "^4.0.0",
-    "cookie-parser": "^1.4.3",
     "csurf": "^1.9.0",
     "css-loader": "^0.25.0",
     "dialog-polyfill": "^0.4.4",

routes/admin/index.js

@@ -2,8 +2,9 @@ const express = require('express');
 const router = express.Router();
 const csrf = require('csurf');
 
-// setup route middlewares for CSRF protection
-const csrfProtection = csrf({cookie: true});
+// Setup route middlewares for CSRF protection.
+// Default ignore methods are GET, HEAD, OPTIONS
+const csrfProtection = csrf({});
 
 // Get /password-reset expects a signed token (JWT) in the hash.
 // Links to this endpoint are generated by /views/password-reset-email.ejs.

routes/index.js

@@ -1,7 +1,10 @@
 const express = require('express');
 const router = express.Router();
 const csrf = require('csurf');
-const csrfProtection = csrf({cookie: true});
+
+// Setup route middlewares for CSRF protection.
+// Default ignore methods are GET, HEAD, OPTIONS
+const csrfProtection = csrf({});
 
 router.use('/api/v1', require('./api'));
 router.use('/admin', require('./admin'));