CSRF Protection — Preventing Cross-Site Request Forgery Attacks

DodaTech Updated 2026-06-28 1 min read

In this tutorial, you'll learn about Csrf Protection. We cover key concepts, practical examples, and best practices to help you understand and apply this topic effectively.

CSRF Attacks trick authenticated users into performing unintended actions. Protection ensures requests originate from legitimate sources.

const csrf = require('csrf');

// Synchronizer token pattern
const tokens = new csrf();

// Generate CSRF token endpoint
app.get('/api/csrf-token', (req, res) => {
  if (!req.session.csrfSecret) {
    req.session.csrfSecret = tokens.secretSync();
  }
  const token = tokens.create(req.session.csrfSecret);
  res.json({ csrfToken: token });
});

// CSRF validation middleware
function csrfProtection(req, res, next) {
  if (['GET', 'HEAD', 'OPTIONS'].includes(req.method)) return next();

  const token = req.headers['x-csrf-token'] || req.body?._csrf;
  if (!token) return res.status(403).json({ error: 'CSRF token required' });

  if (!tokens.verify(req.session.csrfSecret, token)) {
    return res.status(403).json({ error: 'Invalid CSRF token' });
  }

  next();
}

// Double-submit cookie pattern
function doubleSubmitCookie(req, res, next) {
  if (['GET', 'HEAD', 'OPTIONS'].includes(req.method)) return next();

  const cookieToken = req.cookies?.['csrf-token'];
  const headerToken = req.headers['x-csrf-token'];

  if (!cookieToken || !headerToken || cookieToken !== headerToken) {
    return res.status(403).json({ error: 'CSRF validation failed' });
  }

  next();
}

// SameSite cookie configuration
res.cookie('session', token, {
  httpOnly: true,
  secure: true,
  sameSite: 'strict',  // Prevents CSRF for cross-site requests
  path: '/api'
});

CSRF protection is essential for APIs that use cookie-based authentication and accept state-changing requests.

← Previous SQL Injection Prevention — Defending Against SQL Injection Attacks Next → Backend Rate Limiting — Protecting APIs with Rate Limiting

Built by the developers of DodaTech

Doda Browser, DodaZIP & Durga Antivirus Pro

Home Browse Backend Security