3part bind csrf

@@ -9,6 +9,8 @@ const express = require('express');
 const router = express.Router(); // eslint-disable-line
 const cRoot = './controllers';
 const captcha = require('../passport/controllers/captcha');
+const csrf = require('../../doraemon/middleware/csrf')();
+
 
 const newUserController = require(`${cRoot}/new-user`);
 
@@ -161,7 +163,7 @@ router.get('/orders/refundreason', ordersController.refundReason);
 
 
 // router.get('/coupons', CouponsController.index);
-router.get('/user', tabsMiddleware.getCommonHeader, UserController.index);
+router.get('/user', csrf, tabsMiddleware.getCommonHeader, UserController.index);
 
 router.post('/user/edituserinfo', UserController.editUserInfo);
 
@@ -202,7 +204,7 @@ router.get('/bind/douban', bindController.douban.login);
 router.get('/bind/renren', bindController.renren.login);
 router.get('/bind/renren/callback', bindController.renren.callback);
 
-router.post('/cancelbind/:type', bindController.cancelBind);
+router.post('/cancelbind/:type', csrf, bindController.cancelBind);
 
 // 账号安全
 router.get('/account', tabsMiddleware.getCommonHeader, AccountController.index);

@@ -12,6 +12,7 @@
                {{> home/edit/habbit}}
                {{> home/edit/favorite}}
             </div>
+            <input type="hidden" name="_csrf" value="{{../csrfToken}}" />
         </div>
         {{#if isShowTip}}
         <p class="help-us">

+'use strict';
+
+const csrf = require('csurf');
+const csrfInit = csrf();
+const csrfToken = (req, res, next) => {
+    res.locals.csrfToken = req.csrfToken();
+    next();
+}
+
+module.exports = () => {
+    return [csrfInit, csrfToken];
+}
\ No newline at end of file

@@ -29,6 +29,7 @@
     "connect-memcached": "^0.2.0",
     "connect-multiparty": "^2.0.0",
     "cookie-parser": "^1.4.3",
+    "csurf": "^1.9.0",
     "express": "^4.13.1",
     "lodash": "^4.13.1",
     "md5": "^2.1.0",

@@ -12,6 +12,7 @@ var labelMap = {
     alipay: '支付宝',
     wechat: '微信'
 };
+var csrfToken = $('input[name=_csrf]').val();
 
 document.domain = 'yohobuy.com';
 
@@ -144,6 +145,7 @@ $('#Y_bindAccount').on('click', '.account-item .cancel-bind-btn', function() {
             $.ajax({
                 url: url,
                 type: 'POST',
+                data: {_csrf: csrfToken},
                 dataType: 'json'
             })
             .then(function(data) {