CSRF protection in Express - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does CSRF stand for and what problem does it solve?

CSRF stands for Cross-Site Request Forgery. It stops attackers from tricking users into making unwanted actions on websites where they are logged in.

beginner

How does a CSRF token help protect a web app?

A CSRF token is a secret value sent with forms or requests. The server checks this token to make sure the request is from the real user, not a fake source.

intermediate

Which Express middleware is commonly used for CSRF protection?

The 'csurf' middleware is commonly used in Express apps to add CSRF protection by generating and validating tokens.

intermediate

What must you do to use 'csurf' middleware correctly in Express?

You must use cookie-parser or session middleware first, then add 'csurf'. Also, include the CSRF token in your forms or AJAX requests for validation.

intermediate

Why should CSRF tokens be unique per user session?

Unique tokens prevent attackers from guessing or reusing tokens. This ensures only the real user’s requests are accepted.

What is the main purpose of CSRF protection in Express apps?

A Prevent unauthorized commands from trusted users

B Encrypt user passwords

C Improve page load speed

D Validate email addresses

CSRF protection stops attackers from making unwanted actions on behalf of logged-in users.

Which middleware must be used before 'csurf' in Express for it to work properly?

A body-parser only

B cookie-parser or session middleware

C helmet

D cors

'csurf' requires cookie-parser or session middleware to read tokens from cookies or sessions.

How is the CSRF token usually sent back to the server in a form submission?

A As a hidden form field

B In the URL query string

C In the HTTP headers only

D As a cookie only

CSRF tokens are commonly included as hidden fields inside forms to be submitted with user data.

What happens if a request does not have a valid CSRF token when using 'csurf'?

A The request is accepted anyway

B The token is automatically generated

C The server logs the request but processes it

D The request is rejected with an error

'csurf' middleware rejects requests missing or having invalid tokens to protect against CSRF attacks.

Why is CSRF protection important even if you use HTTPS?

A Because HTTPS blocks all cookies

B Because HTTPS slows down the site

C Because HTTPS only encrypts data, it does not stop forged requests

D Because HTTPS disables JavaScript

HTTPS encrypts data but does not prevent attackers from tricking users into sending forged requests.

Explain how CSRF tokens work in an Express app to protect user actions.

Think about how the server knows a request is genuine.

Describe the steps to add CSRF protection using 'csurf' middleware in an Express application.

Consider middleware order and token usage.