CSRF & Authentication

What you'll learn

• 1Explain CSRF in one sentence
• 2Block CSRF with SameSite=Lax/Strict cookies
• 3Use CSRF tokens when SameSite is not enough
• 4Compare session cookies vs JWT (and pick session for new apps)

1. What is CSRF?

An attacker tricks a logged-in user's browser into firing a request to your site, riding on their cookies. The user did not intend it.

<!-- attacker.com -->
<img src="https://yourbank.com/transfer?to=evil&amount=1000">

2. SameSite Cookies (First Line of Defense)

Set-Cookie: session=abc; HttpOnly; Secure; SameSite=Lax; Path=/

• Lax — cookie not sent on cross-site POST (good default)
• Strict — cookie not sent on any cross-site request
• None — only with Secure; needed for embedded contexts

3. CSRF Tokens

Render a per-session random token in your form. The server requires it on submit. The attacker's site cannot read it (Same-Origin Policy).

// Express + csurf
import csurf from "csurf";
app.use(csurf({ cookie: true }));
app.get("/form", (req, res) => {
  res.render("form", { csrfToken: req.csrfToken() });
});
app.post("/transfer", (req, res) => { /* csurf validates automatically */ });

4. Session Cookies vs JWT