CSRF Protection: SameSite Cookie Hardening

Cross-Site Request Forgery (CSRF) is an exploit that tricks a victim's browser into executing state-changing actions (like modifying settings or executing a transfer) inside a web app where they are currently authenticated.

---

The Mechanic of CSRF

If user sessions rely on default cookie parameters, the browser automatically attaches cookies on cross-origin requests. An attacker hosts a malicious website containing an auto-submitting form targeting:

<form action="https://bank.com/api/v1/transfer" method="POST">
  <input type="hidden" name="amount" value="5000" />
</form>

When the victim opens the page, the form submits. The browser sends the session cookies, and the transaction is processed unauthorized.

---

Mitigation Strategies

1. Enforce SameSite=Strict or SameSite=Lax

Modern browsers allow restricting cookie transfers. Ensure all authentication cookies specify the SameSite attribute:

• SameSite=Strict: The cookie is never sent in cross-site requests (even following external links).
• SameSite=Lax: Provides a balance, allowing cookies only on top-level safe navigations (GET).

res.cookie('token', token, { 
  httpOnly: true, 
  secure: true, 
  sameSite: 'strict' 
});

2. Implement Anti-CSRF Tokens

For state-changing operations (POST, PUT, DELETE), issue a cryptographically random, user-specific CSRF token that must be verified in incoming request headers.