Learn about CSRF and how to protect against it in your nodejs app

CSRF (Cross-Site Request Forgery) is a web security vulnerability that tricks a user into performing unwanted actions on a web application where they are authenticated. An attacker exploits the trust that a web application has in the user’s browser by crafting malicious requests that appear to originate from the user.

How CSRF Works

1.Victim Authentication: The user logs into a trusted website (example.com) and has an active session (e.g., a session cookie).

2.Malicious Action:

The attacker crafts a malicious link or form that sends a request to example.com. The victim unknowingly triggers the malicious request by clicking a link, visiting a page, or loading an image.

3.Exploitation:

The browser includes the user’s session cookie or authentication token with the malicious request. The server processes the request as if it were made by the user, potentially performing unauthorized actions (e.g., transferring money, changing account settings).

Use CSRF Tokens:

import csrf from "csurf";

// Allow CSRF tokens to be sent via the "CSRF-Token" header or `_csrf` cookie
const csrfProtection = csrf({
  cookie: true,
  value: (req) => req.headers["csrf-token"] || req.body._csrf, // Check both headers and body for the token
});

export default csrfProtection;

import csrfProtection from "./middleware/csrfMiddleware.js"; // Use your custom CSRF middleware
// CSRF Token Endpoint
app.get("/csrf-token", csrfProtection, (req, res) => {
  res.json({ csrfToken: req.csrfToken() });
});

example of protecting a route

import express from 'express';
const router = express.Router();
import csrfProtection from '../middleware/csrfMiddleware.js'; 

import { changePassword } from '../controllers/authController.js';

router.post('/change-password', ensureAuthenticated, csrfProtection, changePassword); 

export default router;

Require same site cookies:

// Session configuration
app.use(
  session({
    store: MongoStore.create({
      mongoUrl: process.env.MONGO_URI,
    }),
    secret: process.env.SESSION_SECRET,
    resave: false,
    saveUninitialized: false,
    cookie: {
      secure: process.env.NODE_ENV === "production", // Use HTTPS in production
      httpOnly: true, // Prevent JavaScript from accessing cookies
      sameSite: process.env.NODE_ENV === "production" ? "none" : "lax", // 'none' for cross-origin requests
      maxAge: 1000 * 60 * 60 * 24, // 1 day cookie expiration
    },
  })
);

Implement CORS policies:

const corsOptions = {
  origin: process.env.NODE_ENV === "production"
    ? ["https://www.example.com", "https://example.com"]
    : "http://localhost:3000", // Allow localhost during development
  methods: "GET,HEAD,PUT,PATCH,POST,DELETE",
  credentials: true, // Allow sending credentials (cookies)
};

Why Exclude GET Requests?

GET requests are meant to be safe and idempotent, meaning they should not cause any state changes. Including CSRF tokens for GET requests is unnecessary and can lead to usability issues, such as making bookmarks or links unusable.

API Requests Secured via Other Methods:

If you’re using OAuth2, JWT, or similar tokens for API security, CSRF tokens might not be necessary because the API uses Authorization headers rather than cookies for authentication.

Thank you!