'use strict';


var token = require('./token');


/**
 * CSRF
 * https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)
 * @param {Object} options
 *    key {String} The name of the CSRF token in the model. Default "_csrf".
 *    impl {Object} An object with create/validate methods for custom tokens. Optional.
 *    header {String} The name of the response header containing the CSRF token. Default "x-csrf-token".
 */
module.exports = function (options) {
    var impl, key, header, secret;

    options = options || {};

    key = options.key || '_csrf';
    impl = options.impl || token;
    header = options.header || 'x-csrf-token';
    secret = options.secret || '_csrfSecret';

    return function csrf(req, res, next) {
        var method, validate, _impl, _token, errmsg;

        //call impl
        _impl = impl.create(req, secret);
        validate = impl.validate || _impl.validate;
        _token = _impl.token || _impl;
        // Set the token
        res.locals[key] = _token;

        // Move along for safe verbs
        method = req.method;
        if (method === 'GET' || method === 'HEAD' || method === 'OPTIONS') {
            return next();
        }

        // Validate token
        _token = (req.body && req.body[key]) || req.headers[header.toLowerCase()];

        if (validate(req, _token)) {
            next();
        } else {
            res.statusCode = 403;
            if (!_token) {
                errmsg = 'CSRF token missing';
            } else {
                errmsg = 'CSRF token mismatch';
            }
            next(new Error(errmsg));
        }
    };
};

@@ -496,18 +496,26 @@
 , secret
+, cookie
 ;%0A
-
 %0A    opt
@@ -537,16 +537,130 @@
 %7C%7C %7B%7D;%0A%0A
+    if (options.angular) %7B%0A        options.header = 'X-XSRF-TOKEN';%0A        options.cookie = 'XSRF-TOKEN';%0A    %7D%0A%0A
     key 
@@ -812,16 +812,46 @@
 ecret';%0A
+    cookie = options.cookie;%0A%0A
 %0A    ret
@@ -1110,32 +1110,32 @@
 / Set the token%0A
-
         res.loca
@@ -1151,16 +1151,88 @@
  _token;
+%0A        if (cookie) %7B%0A            res.cookie(cookie, _token);%0A        %7D
 %0A%0A      

add angular shorthand option in csrf