csrf useless

[imskull]

I set a breakpoint at csrf.js: // check if (val != token) return next(403); << breakpoint here it never triggered whatever I did. the code is trying to protect res in '/public', but csrf is only avaliable on POST because: ..csrf.js.. // ignore these methods if ('GET' == req.method || 'HEAD' == req.method || 'OPTIONS' == req.method) return next(); it's very weird.