Secure Your Node.js Web Application

Follow the Logic to Protect Against CSRF

Cross-site request forgery requires the site to trust the browser. Attackers abuse this trust by making the browser submit legitimate-looking requests to the web application. We fight this by adding watermarks, or things attackers can’t forge, so that the site can differentiate between legitimate and forged requests.

In a CSRF attack, the attacker forces the browser to make a request. Attackers can’t do that via AJAX because browsers by default don’t allow cross-origin requests. Thus, CSRF is a blind attack, similar to blind SQL injection discussed in ​Avoid SQL Injection Attacks​. Attackers can make the requests but will typically not see the responses.

By default, websites can’t make requests ...