 <p>You can do that in two ways.</p> <p><strong>1.)</strong> Create a small middleware of your own to allow white list url patterns not to be blocked by csrf like;</p> <pre><code>var express = require("express"); var expressCsrf = express.csrf(); var app = express.createServer(); var customCsrf = function (req, res, next) { // I assume exact match, but you can use regex match here var csrfEnabled = true; var whiteList = new Array("/pattern1/param1","/pattern2/param2","/pattern3/param3"); if (whiteList.indexOf(req.path) != -1) { csrfEnabled = false; } if (csrfEnabled) { expressCsrf(req, res, next); } else { next(); } } app.use(customCsrf); app.listen(3000); </code></pre> <p><strong>2.)</strong> Use csrf middleware on your controllers you want to enable. For example, you want to use csrf check on profile save controller;</p> <pre><code>app.post("/profile/save", express.csrf(), function(req, res, next) { // put your code here }); </code></pre>