title: Exception csrfToken is not a function when called by supertest
body: <p>I have a NestJS backend with CSRF protection and an endpoint to get the CSRF token. I'm getting <code>TypeError: req.csrfToken is not a function</code> when testing this endpoint with <strong>jest</strong> and <strong>supertest</strong>.</p>
  <p>My code is like this:</p>
  <pre><code>// main.ts
  async function bootstrap() {
    const app = await NestFactory.create(AppModule);
  
    app.use(cookieParser());
    app.use(csurf({ cookie: true }));
  
    await app.listen(process.env.BACKEND_SERVER_PORT);
  }
  
  // authController.ts
  import { Controller, Req, Get } from &quot;@nestjs/common&quot;;
  import { Request } from &quot;express&quot;;
  import * as AuthDto from &quot;./modules/auth/dto/auth.dto&quot;;
  
  @Controller(&quot;auth&quot;)
  export class AppController {
    constructor() {}
  
    @Get(&quot;csrf&quot;)
    async getCsrfToken(@Req() req: Request): Promise&lt;AuthDto.CsrfOutput&gt; {
      return { csrfToken: req.csrfToken() };  // &lt;-- ERROR HAPPENS HERE
    }
  }
  
  // app.controller.spec.ts
  import { Test, TestingModule } from &quot;@nestjs/testing&quot;;
  import { INestApplication } from &quot;@nestjs/common&quot;;
  import request from &quot;supertest&quot;;
  import AppModule from &quot;../src/app.module&quot;;
  
  describe(&quot;AppController (e2e)&quot;, () =&gt; {
    let app: INestApplication;
    let server: any;
  
    beforeAll(async () =&gt; {
      const moduleFixture: TestingModule = await Test.createTestingModule({
        imports: [AppModule],
      }).compile();
  
      app = moduleFixture.createNestApplication();
      await app.init();
      server = app.getHttpServer();
    });
  
    it(&quot;/csrf (GET)&quot;, () =&gt; {
      return request(server).get(&quot;/auth/csrf&quot;).expect(200).expect(&quot;hello&quot;);
      // I'll add more validations here once I get past this error
    });
  });
  </code></pre>
  <p>I believe this may be related with the test itself, since this endpoint is working fine when called by an external client (our frontend application or Postman). It just doesn't work with supertest.</p>
  <p>Anybody has an idea why? Thanks.</p>