const csrf = require('csurf'); const csrfProtection = csrf({ cookie: { httpOnly: true, secure: true, sameSite: 'strict' } }); app.use('/admin', csrfProtection); app.get('/admin/csrf-token', (req, res) => { res.json({ csrfToken: req.csrfToken() }); });