When doing a POST or PUT request with the new-ish fetch() API:

fetch('/URL', {
  method: 'PUT',
  body: 'whatever',
  headers: { 'csrf-token': csrf }
}).then(res => res.json()).then(res => {
  console.log(res);
});

I receive a typical error of:

ERROR { ForbiddenError: invalid csrf token
...
code: 'EBADCSRFTOKEN' }

After many hours searching the web a

I'm newbie in everything.

I would like to write a Wiki page for newbies like me. Would you mind, @justinas?

Title: "How to use nosurf with external Single Page Application (SPA) like Ember, React, Angular or jQuery Ajax".

My app is both SPA and server rendered: authentication (using authboss - https://github.com/volatiletech/authboss) and I also have the Javascript part, so I need

Hello,
I'm interested in using this project, but there are still some obscure undocumented aspects. The first one is the schedule method in the RefreshTokenStorage. Can you please clarify what is this for and how is it intended to be implemented?
Also the after parameter should probably be a FiniteDuration rather than simply Duration, should it not?
Is there a plan to work on some bet