CSRF protection imported is actually applied

Installing csurf or csrf-csrf and never calling app.use(csrfProtection) or the library's equivalent wrapper leaves every state-mutating route open to cross-site request forgery. OWASP A01 (Broken Access Control) and CWE-352 describe the attack: a malicious third-party page can POST to your /api/transfer endpoint using a victim's session cookie, and your server will accept it as a legitimate request. The library is evidence that the developer knew CSRF was a risk — the installation without application is the exact theater pattern.

Apply the CSRF middleware to all state-mutating routes. For Express with csurf:

import csurf from 'csurf'
const csrfProtection = csurf({ cookie: true })

// Apply to individual routes
app.post('/api/transfer', csrfProtection, handler)

// Or globally, then exclude safe methods
app.use(csrfProtection)

For Next.js App Router, use csrf-csrf or @edge-csrf/nextjs and wrap your API handlers. Verify the token is read from a header or double-submit cookie, not just from req.body. The CSRF token must be included in every form or mutation client request.