How do Cross-Site Request Forgery (CSRF) attacks work, and how do you protect Node.js applications from them?

Short answer

They occur when a malicious site tricks a victim's browser into sending your site an unauthorized request with the victim's cookies; protection includes a CSRF Token and SameSite=Lax/Strict.

Explanation

If your site relies on cookies for automatic authentication, an external page can submit a POST form to the user's account. A modern solution is to set SameSite=Lax or Strict on sensitive cookies so the browser does not attach them to cross-site requests, and to apply the Double Submit Cookie or Synchronizer Token Pattern to state-changing requests.

Code example

// Set SameSite on cookies for immediate protection
res.cookie("session", id, { sameSite: "lax", httpOnly: true, secure: true });

Common mistakes

• Relying on SameSite=None without manually validating CSRF Tokens.

Follow-up questions

• How do you implement Refresh Token Rotation and secure storage in cookies?

Sources

• OWASP — Cross-Site Request Forgery Prevention Cheat Sheet