Guarding against cross-site request forgery attacks
CSRF is an attack where a malicious web application causes a user's web browser to execute an action on another trusted web application where the user is logged in.
In this recipe, we're going to learn how we would secure an Express.js server against CSRF attacks.
Important Note
Browser security has improved significantly in recent years. It's very difficult to replicate a CSRF attack on any modern browser. However, as there are still many users on older browsers, it's important to understand how these attacks work and how to protect against them. In the recipe, we will replicate a CSRF attack on the same domain. Refer to the Developers: Get Ready for New SameSite=None; Secure Cookie Settings (https://blog.chromium.org/2019/10/developers-get-ready-for-new.html) Chromium blog, which covers some of the updates that have been made to Google Chrome to prevent CSRF attacks.
Getting ready
- Start by...
