Kraken.js + Lusca integration: declarative CSRF config and session middleware ordering

Verifying Lusca CSRF middleware order in a Kraken.js app

Confirmed facts

• Kraken inserts Lusca modules listed under the lusca key in the environment config file after its core middleware and before user‑defined routes, preserving the order they appear in the config object.
• Lusca’s CSRF middleware depends on req.session being present; if session middleware runs after Lusca CSRF, validation is silently skipped.
• In a default Kraken scaffold no Lusca protections are enabled; each module (csrf, csp, hsts, xframe, xssProtection, p3p) must be declared explicitly.

Likely explanation

Because Kraken controls the middleware stack declaratively, you can only guarantee CSRF runs after session by ensuring the session middleware appears earlier in the Kraken‑managed stack (e.g., via middleware array in config.json or by registering it before Kraken boots). If the session middleware is added imperatively after Kraken starts, the order cannot be guaranteed from config alone.

Steps to verify from configuration or response

1. Open the environment file (e.g., production.json) and confirm the lusca object contains a csrf entry.
2. Check that a session middleware is registered before Kraken’s boot. In config.json you can add a middleware array with an entry like { "name": "express-session", "args": [...] } or ensure you call app.use(session(...)) before require(' kraken-js')(app, config).
3. Start the app and add a temporary logging middleware (e.g., app.use((req, res, next)=>{ console.log('layer', this.name || this.handle.name); next(); })) before defining routes. Look at the console output: the session layer should appear before any layer whose name contains “lusca” or “csrf”.
4. Make a GET request to a page that renders a form (using curl or a browser). Verify the response includes an X‑CSRF‑Token or that a test endpoint returns req.csrfToken() as a function.
5. Submit a POST to the same form with an empty or incorrect _csrf field. Expect a 403 Forbidden response. A 2xx indicates CSRF enforcement is not active.

Startup assertion (optional)

If you want the app to fail to start when the order is wrong, add a boot‑script that runs after Kraken has finished middleware registration:

// bootstrap.js
const assert = require('assert');
module.exports = function (app) {
  const stack = app._router.stack;
  let sessionIdx = -1, csrfIdx = -1;
  stack.forEach((layer, i) => {
    const name = (layer.handle.name || '').toLowerCase();
    if (name.includes('session')) sessionIdx = i;
    if (name.includes('lusca') && name.includes('csrf')) csrfIdx = i;
  });
  if (sessionIdx === -1) throw new Error('No session middleware found');
  if (csrfIdx === -1) throw new Error('Lusca CSRF middleware not found');
  if (csrfIdx < sessionIdx) throw new Error('Lusca CSRF must run after session middleware');
};

Register this script in config.json under the boot array (Kraken will execute it after loading middleware). If the assertion fails, the process exits with an error, preventing a silent misconfiguration.
Missing diagnostic detail
To give a definitive ordering check, confirm which session middleware you are using (e.g., express-session or a custom store). If you are using a custom session implementation that does not include the word “session” in its middleware name, adjust the boot‑script’s name‑matching accordingly.