Medium ThreatWeb & Injection DefenseCWE-352
Modern CSRF Defense: SameSite Cookies & Custom Headers
Implement modern CSRF defense strategies including SameSite cookies, double-submit tokens, and custom header validation.
Vulnerability Overview
Browsers automatically send cookies with cross-site requests.
Attackers host forms that submit to authenticated endpoints.
Vulnerable Code
res.cookie('session', token);Defaults to SameSite=None in older setups.
Remediated Code
res.cookie('session', token, { sameSite: 'strict' });Prevents cross-site cookie sending.
Hardening Rules
- 1Use SameSite=Lax/Strict
- 2Require custom headers
- 3Use anti-CSRF tokens for legacy browsers
Frequently Asked Questions
Does CORS prevent CSRF?
No, CORS relaxes the Same-Origin Policy but does not prevent state-changing requests.