diff --git a/services/web/app/src/infrastructure/Csrf.js b/services/web/app/src/infrastructure/Csrf.js
index 8b7099d8e1..add6a1b4f1 100644
--- a/services/web/app/src/infrastructure/Csrf.js
+++ b/services/web/app/src/infrastructure/Csrf.js
@@ -12,9 +12,10 @@
  * DS207: Consider shorter variations of null checks
  * Full docs: https://github.com/decaffeinate/decaffeinate/blob/master/docs/suggestions.md
  */
-let Csrf
+
 const csurf = require('csurf')
 const csrf = csurf()
+const { promisify } = require('util')
 
 // Wrapper for `csurf` middleware that provides a list of routes that can be excluded from csrf checks.
 //
@@ -27,9 +28,9 @@ const csrf = csurf()
 //   myRouter.csrf.disableDefaultCsrfProtection "/path" "METHOD"
 //
 // To validate the csrf token in a request to ensure that it's valid, you can use `validateRequest`, which takes a
-// request object and calls a callback with either true or false.
+// request object and calls a callback with an error if invalid.
 
-module.exports = Csrf = class Csrf {
+class Csrf {
   constructor() {
     this.middleware = this.middleware.bind(this)
     this.excluded_routes = {}
@@ -71,7 +72,7 @@ module.exports = Csrf = class Csrf {
     if (cb == null) {
       cb = function(valid) {}
     }
-    return csrf(req, null, err => cb(err == null))
+    return csrf(req, null, err => cb(err))
   }
 
   static validateToken(token, session, cb) {
@@ -94,3 +95,9 @@ module.exports = Csrf = class Csrf {
     return Csrf.validateRequest(req, cb)
   }
 }
+
+Csrf.promises = {
+  validateRequest: promisify(Csrf.validateRequest)
+}
+
+module.exports = Csrf
diff --git a/services/web/test/unit/src/infrastructure/CsrfTests.js b/services/web/test/unit/src/infrastructure/CsrfTests.js
index 30ca65a7a7..302b60625a 100644
--- a/services/web/test/unit/src/infrastructure/CsrfTests.js
+++ b/services/web/test/unit/src/infrastructure/CsrfTests.js
@@ -126,15 +126,15 @@ describe('Csrf', function() {
 
   describe('validateRequest', function() {
     describe('when the request is invalid', function() {
-      it('calls the callback with `false`', function() {
+      it('calls the callback with error', function() {
         this.cb = sinon.stub()
         this.Csrf.validateRequest(this.req, this.cb)
-        return expect(this.cb.calledWith(false)).to.equal(true)
+        return expect(this.cb.calledWith(this.err)).to.equal(true)
       })
     })
 
     describe('when the request is valid', function() {
-      it('calls the callback with `true`', function() {
+      it('calls the callback without an error', function() {
         this.Csrf = SandboxedModule.require(modulePath, {
           globals: {
             console: console
@@ -147,7 +147,7 @@ describe('Csrf', function() {
         })
         this.cb = sinon.stub()
         this.Csrf.validateRequest(this.req, this.cb)
-        return expect(this.cb.calledWith(true)).to.equal(true)
+        return expect(this.cb.calledWith()).to.equal(true)
       })
     })
   })
@@ -157,7 +157,7 @@ describe('Csrf', function() {
       it('calls the callback with `false`', function() {
         this.cb = sinon.stub()
         this.Csrf.validateToken('token', {}, this.cb)
-        return expect(this.cb.calledWith(false)).to.equal(true)
+        expect(this.cb.calledWith(this.err)).to.equal(true)
       })
     })
 
@@ -175,7 +175,7 @@ describe('Csrf', function() {
         })
         this.cb = sinon.stub()
         this.Csrf.validateToken('goodtoken', {}, this.cb)
-        return expect(this.cb.calledWith(true)).to.equal(true)
+        return expect(this.cb.calledWith()).to.equal(true)
       })
     })