node.js - How to resolve issue with handling csrf with multiple tabs in express/nodejs? -

i built csrf protection in nodejs/express application following config:

var app = express(),     cookieparser = require('cookie-parser'),     session = require('express-session'),     csrf = require('csurf');  app.use(cookieparser()); app.use(session({     , saveuninitialized: true     , resave: true     , store: new mongostore() }));  app.use(flash()); 

and following login form:

<form action="/process" method="post">   <input type="hidden" name="_csrf" value="{{csrftoken}}">   <button type="submit">submit</button> </form> 

the problem arives when user opens 2 browser tabs , end of story getting ebadcsrftoken error @ this line:

let's see following case:

1. user opens form above in 2 separate tabs.
2. in first tab logout , signin again.
3. then switches second tab, click submit , ebadcsrftoken error.

i need point destroy session in logout route:

app.route('/auth/signout')     .get(function (req, res, next) {          return req.session.destroy(function (err) {             if (err) return next(err);              return res.redirect('/');         });     }); 

because fact destroy session destroy secret key stored there. destroing leads invalid token on second tab , ebadcsrftoken error.

i need resolve case somehow. in case? show popup reload page or reload page automatically?

the csrf token should set , retrieved cookie before form submission. suppose, open taba csrf c1. once open tab2, csrf changes c2. but, if set in cookies, fetching csrf cookies in taba give c2 csrf token.

same thing can concluded session->logout->new_session. save , fetch cookie. since logged in after logout in tab2, tab1 have cookies of tab2 , csrf token.