@pano9000 , would there be anything else left to do here? I see it's in draft.

yeah, I was waiting for some feedback from the original developer of the csrf-csrf module regarding the secret usage – I did get a reply a couple of days ago, so I will be continuing on this soon again.
Apart from that I also had some TS type issues, but they might be gone, after I implement that point above

@eliandoran I am now running into another issue that appears with the logout POST request, which causes the CSRF validation of csrf-csrf (it compares the value from the cookie "_csrf" AND the "x-csrf-token" header.) to fail.

Unfortunately the logout action uses standard form submission via POST, which is not capable of including custom HTTP headers, like the required "x-csrf-token" – this then causes a "Invalid CSRF Token" 403 error, because the values of cookie and custom Header are of course not identical when compared with each other (since the x-csrf-token value is undefined).

This affects all routes, that use the csrfMiddleware and which are sent via Form Submssion – which currently really just seems to be the logout action, the other routes that use "simple" form submissions do not have csrf set as middleware.

I need to do some additional checking here on how to handle this the best way

I found a way, which feels a tad bit "hack-ish" though, but works by reusing existing code mostly:

In entrypoint.ts changing the previous form based submit

    logoutCommand() {
        const $logoutForm = $('<form action="logout" method="POST">')
            .append($(`<input type='_hidden' name="_csrf" value="${glob.csrfToken}"/>`));

        $("body").append($logoutForm);
        $logoutForm.trigger('submit');
    }

to a JS triggered one like below:

    async logoutCommand() {
        // forced to use relative path here, because `server.post` is using "/api" as base path, 
        // but we want to navigate to "/logout"
        // this regenerates the session token and currently redirects to "/login",
        // causing the function call below to return the /login page's HTML, which is useless here though
        await server.post("../logout");

        // "manually redirect" to the login page
        window.location.replace("/login");
    }

by using server.post the x-csrf-token header AND the _csrf cookie value is sent to the server, and the csrf validation passes

@eliandoran
let me know if that would be an OK solution – currently I have this change above locally only.