CSRF protection in Express - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import the CSRF middleware in Express.

Express

const csrf = require('[1]');

Drag options to blanks, or click blank then click option'

Aexpress-session

Bcsurf

Cbody-parser

Dcookie-parser

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'express-session' instead of 'csurf'.

Confusing cookie-parser with CSRF middleware.

The csurf package provides CSRF protection middleware for Express.

2fill in blank

medium

Complete the code to add CSRF protection middleware to the Express app.

Express

app.use(csrf({ [1] }));

Drag options to blanks, or click blank then click option'

Acookie: true

Bsession: true

CignoreMethods: ['GET']

Dsecure: true

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'session: true' without session middleware.

Confusing 'ignoreMethods' with cookie option.

Setting cookie: true tells csurf to store the CSRF token in a cookie.

3fill in blank

hard

Fix the error in the code to correctly send the CSRF token to the client in a template.

Express

res.render('form', { csrfToken: req.[1]() });

Drag options to blanks, or click blank then click option'

Atoken

Bcsrf_token

CcsrfToken

Dcsrf

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'csrfToken' property instead of calling the method.

Using incorrect property names like 'token' or 'csrf_token'.

The CSRF token is generated by calling the req.csrfToken() method.

4fill in blank

hard

Fill both blanks to correctly set up CSRF protection with cookie parser and session in Express.

Express

app.use([1]());
app.use([2]());

Drag options to blanks, or click blank then click option'

AcookieParser

BexpressSession

CbodyParser

Dhelmet

Attempts:

3 left

💡 Hint

Common Mistakes

Reversing the order of middleware.

Using unrelated middleware like 'helmet' or 'bodyParser' here.

To use CSRF protection with cookies and sessions, you first add cookie-parser middleware, then session middleware like express-session.

5fill in blank

hard

Fill all three blanks to create a dictionary of CSRF tokens for multiple forms in Express.

Express

const tokens = {
  login: req.[1](),
  signup: req.[2](),
  reset: req.[3]()
};

Drag options to blanks, or click blank then click option'

AcsrfToken

Dtoken

Attempts:

3 left

💡 Hint

Common Mistakes

Using different method names for each form.

Using 'token' instead of 'csrfToken'.

The CSRF token is generated by calling req.csrfToken() each time you need a token for a form.