I need this CSRF token on all my pages,
because I need it for the logout button header.
And therefore, basically all pages need that CSRF Token.
Of course, at the moment,
I'm always generating and passing the CSRF token
into every template therefore.
So, every route that renders a template,
also passes into CSRF token,
because I'm referring to that token in my header include.
There, I have this input.
This works, but it's a bit annoying and easy to overlook.
Therefore, instead of doing it like this,
I actually would rather not pass it in,
in all those render method calls.
Instead, I wanna use this res.locals approach again,
to automatically set it for all the responses
that are generated.
And we can do this in app.js.
Here, after initializing the CSRF package,
I actually will use my own custom middleware,
which should add this res.locals field,
with the generated CSRF token.
And we could do this in line here,
but since we learned about creating a middlewares folder
for our own middlewares,
I'll add my own csrftokenmiddleware.js file in there.
And in this CSRFtokenmiddleware.js file,
all add a function,
Add CSRF Token could be the name,
where I get a request, a response, and this next function,
because this function should act
as a regular express middleware.
And all express middlewares get requests and responses
and this next function.
And I will then generate my CSRF token here,
by calling req.CSRF token as a method.
That is possible, because the CSRF package adds this method.
Then I reach out to res.locals,
and add my CSRF token like that.
Of course, alternatively, we do this in one line only,
like this that also works.
And then there after, I call next,
so that we continue with the next middleware in line.
And then here, I'll just export
this add CSRF Token function,
so that it can be used in other files.
Because now in app.js, here I wanna use that.
I will add my Add CSRF token middleware here.
Let's also name it,
Add CSRF Token Middleware,
to be in line with that name I chose here.
Though the name, of course, is up to you.
And reach out to middlewares, CSRF token middleware.
And then after initializing the CSRF token,
I'll activate my own Add CSRF Token middleware.
And that will add that CSRF token to the res.locals field.
Now you learned before that everything that's stored in this
res.locals field,
is automatically available in all the templates.
We just have to access it a bit differently.
In the header EJS file now, it's not CSRF token like this,
but instead locals.csrftoken.
That's how we get access to the data,
stored in res.locals.
And I'll do this in all my other forms as well now,
like in the post-form.
There I now access locals.csrftoken.
And in post-item, where I also have a form for deleting.
I also access locals.csrftoken.
And in login, where I also have a form,
it's now also locals.csrftoken.
And the same in signup.
Here I also have locals.csrftoken.
With that, we can go back to the post-controller.
And there, actually search for all the occurrences
of CSRF token,
and removed that,
because it's now always added through res.locals.
So we can now get rid of it like this.
And then also already dive into the auth routes again,
and search for the CSRF tokens there as well,
to also remove them there as well, in all these places.
And with that, we should still be able to navigate around,
still log out successfully without errors and log back in.
And still create a new post, This works,
that also works.
And with that,
we are ensuring that we now also do provide the CSRF token
in a more convenient way.
And that was a lot of refactoring.
Now, you can always do more.
You can do more.
You can refactor more,
and definitely feel free to explore
other possible optimizations that come to your mind.
Play around with the code.
That's the best practice of all.
Here in this demo project, we're basically done.
Though, of course, the auth routes are totally
not refactored.
We're not using the MVC pattern here.
We didn't refactor anything.
And that is simply a good practice for you.
Try refactoring the auth routes here,
as you'll learn it with the tools you'll learned it.
And of course there won't be a single right solution,
but definitely try applying the MVC pattern.
See how you could apply this here,
and see how you could refactor this to make the
routes file slimmer,
and to implement the MVC pattern.
In the next lecture,
I'll come back to you with my already refactored code,
and I'll walk you through the refactorings I did there,
and why I did them.