What is CSRF and when do you need protection?

Authentication and security · Freshers and experienced

Model answer

Cross-site request forgery tricks a logged-in user's browser into sending a request to your site, and cookies are sent automatically. If you use cookie-based auth, protect with SameSite cookies, CSRF tokens and checking Origin headers. APIs that read a token from an Authorization header set by your own JavaScript are not vulnerable in the same way.

Learn this topic

Login with JWT: Sign In, Issue a Token and Avoid Timing Leaks in the course MERN Stack Full Course: MongoDB, Express, React and Node.js.

Sign in to add your own answer.

More questions

• How should you store passwords?
• What is a JWT and how is it used for login?
• What is the difference between authentication and authorisation?
• How do you write authentication middleware in Express?
• Where should you store a JWT in the browser?
• What is an ownership check and why is it important?