Skip CSRF protection for AJAX requests for Express

skip_ajax.js

var express = require('express');
var connect = require('connect');
 
// Disable CSRF for some requests
var conditionalCSRF = function (req, res, next) {
  req.session._csrf || (req.session._csrf = connect.utils.uid(24));
 
  if (req.method !== 'POST') {
    next();
    return;
  }
  if (req.xhr) {
    next();
  } else {
    (express.csrf())(req, res, next);
  }
};
 
app.use(conditionalCSRF);