Disable it for API routes

[razvanz]

My node application routes the requests in two main categories /app, /api. The application uses csurf as described in the examples.

How can I disable it for the /api routes since I'm using token authentication (RFC 6750) and I don't want CSRF protection.

[dougwilson]

Rather than doing app.use(csurf()), you can do app.use('/app', csurf()) so that it only applies to your /app routes.

[razvanz]

Thanks!