icynet-auth-server/src/middleware/csrf.middleware.ts

import { Injectable, NestMiddleware } from '@nestjs/common';
import { NextFunction, Request, Response } from 'express';
import { TokenService } from 'src/modules/utility/services/token.service';

@Injectable()
export class CSRFMiddleware implements NestMiddleware {
  constructor(private readonly tokenService: TokenService) {}

  use(req: Request, res: Response, next: NextFunction) {
    // TODO: do not store in session, keep the amount of pointless sessions down
    if (!req.session.csrf) {
      req.session.csrf = this.tokenService.generateString(64);
    }
    next();
  }
}