diff --git a/server/app-factory.js b/server/app-factory.js
new file mode 100644
index 00000000..a43bf013
--- /dev/null
+++ b/server/app-factory.js
@@ -0,0 +1,58 @@
+const express = require('express')
+const app = express()
+const session = require('express-session')
+const MemoryStore = require('memorystore')(session)
+const bodyParser = require('body-parser')
+const cookieParser = require('cookie-parser')
+const passport = require('passport')
+const morgan = require('morgan')
+const logger = require('./utils/logging')
+const routes = require('./routes')
+const metricsMiddleware = require('../server/utils/metrics')
+const csurf = require('csurf')
+
+class App {
+  createApp () {
+    app.use(metricsMiddleware)
+    app.use(morgan('short', { stream: logger.logger.stream }))
+    app.use(bodyParser.json())
+    app.use(bodyParser.urlencoded({ extended: false }))
+    app.use(cookieParser())
+    app.use(csurf({ cookie: true }))
+
+    app.use(session({
+      cookie: {
+        maxAge: 86400000
+      },
+      store: new MemoryStore({
+        checkPeriod: 86400000 // prune expired entries every 24h
+      }),
+      secret: 'wtf',
+      resave: false,
+      saveUninitialized: false
+    }))
+
+    app.use(passport.initialize())
+    app.use(passport.session())
+    app.use('/passport', routes)
+
+    // Default error handler
+    // eslint-disable-next-line no-unused-vars
+    app.use((err, req, { redirect }, next) => {
+      logger.log2('error', `Unknown Error: ${err}`)
+      logger.log2('error', err.stack)
+      redirect(
+    `${global.basicConfig.failureRedirectUrl}?failure=An error occurred`
+      )
+    })
+    passport.serializeUser((user, done) => {
+      done(null, user)
+    })
+    passport.deserializeUser((user, done) => {
+      done(null, user)
+    })
+    return app
+  }
+}
+
+module.exports = App
diff --git a/server/app.js b/server/app.js
index 61f8eb2f..db4c8990 100644
--- a/server/app.js
+++ b/server/app.js
@@ -1,64 +1,17 @@
-
 const config = require('config')
-const express = require('express')
-const session = require('express-session')
-const MemoryStore = require('memorystore')(session)
-const bodyParser = require('body-parser')
-const cookieParser = require('cookie-parser')
-const passport = require('passport')
-const morgan = require('morgan')
 const logger = require('./utils/logging')
 const misc = require('./utils/misc')
 const confDiscovery = require('./utils/configDiscovery')
-const routes = require('./routes')
 const providers = require('./providers')
 const passportFile = config.get('passportFile')
-const metricsMiddleware = require('../server/utils/metrics')
-
-const app = express()
+const AppFactory = require('./app-factory')
 
-var httpServer; var httpPort = -1
+var httpServer
+var httpPort = -1
 process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'
 
-app.use(metricsMiddleware)
-app.use(morgan('short', { stream: logger.logger.stream }))
-app.use(bodyParser.json())
-app.use(bodyParser.urlencoded({ extended: false }))
-app.use(cookieParser())
-
-app.use(session({
-  cookie: {
-    maxAge: 86400000
-  },
-  store: new MemoryStore({
-    checkPeriod: 86400000 // prune expired entries every 24h
-  }),
-  secret: 'wtf',
-  resave: false,
-  saveUninitialized: false
-}))
-
-app.use(passport.initialize())
-app.use(passport.session())
-app.use('/passport', routes)
-
-// Default error handler
-// eslint-disable-next-line no-unused-vars
-app.use((err, req, { redirect }, next) => {
-  logger.log2('error', `Unknown Error: ${err}`)
-  logger.log2('error', err.stack)
-  redirect(
-    `${global.basicConfig.failureRedirectUrl}?failure=An error occurred`
-  )
-})
-
-passport.serializeUser((user, done) => {
-  done(null, user)
-})
-
-passport.deserializeUser((user, done) => {
-  done(null, user)
-})
+const appFactory = new AppFactory()
+const app = appFactory.createApp()
 
 /**
  * Creates express server for the first time and recreates if port changed
@@ -80,7 +33,6 @@ function recreateHttpServer (serverURI, port) {
         'info', 'Server stopped accepting connections')
       )
     }
-
     httpServer = app.listen(port, () => {
       logger.log2('info', `Server listening on ${serverURI}:${port}`)
       console.log(`Server listening on ${serverURI}:${port}`)
@@ -142,4 +94,5 @@ function init () {
 }
 
 module.exports = app
+
 init()