CSRF Token from Browser Extension
<p>I have an express app using krakenjs/lusca to protect against CSRF attacks, which works for all routes within my domain. However, I also have a chrome extension that I would like to be able to use to POST to the app from any domain. From my research, I believe I should use token based authentication, so I have two questions:</p>

<ol>
<li>How should I generate and send that token to the extension to permit
the app to authenticate the request from the extension?</li>
<li>How should I store that token with the extension? </li>
</ol>

<p>The answers I have found concern having an api which the server makes requests to, and token storage that relies on local storage (which I don't think will solve my problem since the extension should be able POST from arbitrary domains). I appreciate any help! Thank you. </p>