diff --git a/app.js b/app.js
index 226b0c1ec..15a7a5442 100644
--- a/app.js
+++ b/app.js
@@ -7,7 +7,6 @@ const passport = require('./services/passport');
 const session = require('express-session');
 const RedisStore = require('connect-redis')(session);
 const redis = require('./services/redis');
-const cookieParser = require('cookie-parser');
 
 const app = express();
 
@@ -65,11 +64,6 @@ if (app.get('env') === 'production') {
 
 app.use(session(session_opts));
 
-//==============================================================================
-// AUTHENTICATION TOKEN MIDDLEWARE
-//==============================================================================
-app.use(cookieParser());
-
 //==============================================================================
 // PASSPORT MIDDLEWARE
 //==============================================================================
diff --git a/package.json b/package.json
index e38809065..24a0b609f 100644
--- a/package.json
+++ b/package.json
@@ -90,7 +90,6 @@
     "chai": "^3.5.0",
     "chai-http": "^3.0.0",
     "copy-webpack-plugin": "^4.0.0",
-    "cookie-parser": "^1.4.3",
     "csurf": "^1.9.0",
     "css-loader": "^0.25.0",
     "dialog-polyfill": "^0.4.4",
diff --git a/routes/admin/index.js b/routes/admin/index.js
index dd321fbce..d9fb7c1d8 100644
--- a/routes/admin/index.js
+++ b/routes/admin/index.js
@@ -2,8 +2,9 @@ const express = require('express');
 const router = express.Router();
 const csrf = require('csurf');
 
-// setup route middlewares for CSRF protection
-const csrfProtection = csrf({cookie: true});
+// Setup route middlewares for CSRF protection.
+// Default ignore methods are GET, HEAD, OPTIONS
+const csrfProtection = csrf({});
 
 // Get /password-reset expects a signed token (JWT) in the hash.
 // Links to this endpoint are generated by /views/password-reset-email.ejs.
diff --git a/routes/index.js b/routes/index.js
index 183b35c7a..4de901eb3 100644
--- a/routes/index.js
+++ b/routes/index.js
@@ -1,7 +1,10 @@
 const express = require('express');
 const router = express.Router();
 const csrf = require('csurf');
-const csrfProtection = csrf({cookie: true});
+
+// Setup route middlewares for CSRF protection.
+// Default ignore methods are GET, HEAD, OPTIONS
+const csrfProtection = csrf({});
 
 router.use('/api/v1', require('./api'));
 router.use('/admin', require('./admin'));