title: Angular, Expressjs and Lusca csrf protection
body: <p>I am investigating csrf protection with my Angularjs and Expressjs (4.x) app.</p>
  
  <p>I am currently trying to get Lusca (<a href="https://www.npmjs.org/package/lusca" rel="nofollow">https://www.npmjs.org/package/lusca</a>) to work having not been successful with the standard csrf package (<a href="https://www.npmjs.org/package/csrf" rel="nofollow">https://www.npmjs.org/package/csrf</a>).</p>
  
  <p>I have included lusca like so:</p>
  
  <pre><code>var lusca = require('lusca');
  app.use(lusca.csrf());
  </code></pre>
  
  <p>and in my Angularjs app I have this in my main app.js file: </p>
  
  <pre><code>app.run(function($rootScope, $http, $cookies, user) {
  
    $http.defaults.headers.post['x-csrf-token'] = $cookies._csrf;
  
  });
  </code></pre>
  
  <p>however, I'm always getting a 403 error when I try to POST anything to the node server. Can anyone help or even show me the way with the standard csrf package?</p>