csurf VS body-parser

To learn more about CSRF. Go here Consider using csurf

Additionally, I don't mean to offend you, but I doubt your bot will be "secure" if you don't have the appropriate knowledge and experience of secure programming practices. For example, consider this piece of code from the popular (now deprecated) csurf:

it's looking like express/csurf is archived and deprecated (as of 5 hours ago)... ref

If you use Express, I recommend using the csurf library since it's more robust and flexible compared to what I could show in this example above.

We will use a popular npm package to handle CSRF called csurf.

Using body-parser you can set the limit on the size of the payload

body-parser is a middleware that parses the body of incoming requests, and exposes the resulting object on req.body

Now that our app can send us messages, can we send messages back to it? Let's implement the slash command, which will allow us to ask our app for some of its important stats and info. This time, Slack will send an HTTP POST to our app. If we take a look at the Slack docs again, we notice that Slack will send the slash command instruction to the URL we specified in the command set up earlier. We can also see that the POST payload is in the format application/x-www-form-urlencoded. We can set up a body-parser to interpret this data.

Our server application is a very simple one. We just render a simple HTML page with a form and input field to search for the user name. And we are using pug as our template engine for the express app and the body-parser library which is Node.js body parsing middleware to parse incoming request bodies in a middleware before your handlers, available under the req.body property.

Body-parser