import type { Request, RequestHandler, Response } from 'express';
export interface CSRFOptionsResponse extends Response<any, {
    generateToken: typeof defaultGenerateToken;
    verifyToken: typeof defaultVerifyToken;
} & Record<string, any>> {
}
export interface CSRFOptions {
    generateToken?: (req: Request, res: CSRFOptionsResponse) => void | Promise<void>;
    verifyToken?: (req: Request, res: CSRFOptionsResponse) => Promise<void> | void;
}
/**
 *
 * @param req
 * @param res
 * @see https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#employing-hmac-csrf-tokens
 * @note: 我们需要意识到 1. csrf token 不会被攻击者从 cookie 中得到 2. csrf token 的校验是需要当前用户的 login token 的，3. csrf token 不应该有过期时间
 * @returns
 */
declare function defaultGenerateToken(req: Request, res: CSRFOptionsResponse): void;
declare function defaultVerifyToken(req: Request): void;
export declare function csrf(options?: CSRFOptions): RequestHandler;
export {};