« Previous
Next »
CSRF HOME
Welcome to the iwantcoding.com CSRF Tutorial. CSRF tricks a logged-in browser into doing something the user didn’t intend. SameSite cookies, anti-forgery tokens, and Origin checks are the defences — here’s how to wire them correctly.
What this tutorial covers
| Chapter | You will learn |
|---|---|
| CSRF | How it works, ambient authority, classic form, JSON / API, login CSRF, safe demo lab. |
| Prevention | Synchronizer tokens, double-submit cookies, SameSite, Origin / Referer checks, CORS preflight, framework defaults, SPAs & JWT vs cookies. |
| Detection | Code review, automated tests, anomaly monitoring. |
| Examples | Cheatsheet, runnable snippets, quiz, exercises, bootcamp, certificate. |
Who this is for
- Backend devs writing state-changing endpoints.
- AppSec engineers reviewing auth flows.
- SPA devs choosing between cookies and bearer tokens.
How to use this tutorial: read the chapter, run the example with Try it Yourself », do the exercise, then take the quiz at the bottom. Hit Mark complete when you're done — the sidebar will track your progress.
Example
Example
// VULNERABLE: cookie auth + no CSRF defence
app.post('/transfer', requireAuth, (req, res) => transfer(req.body));
// SAFE: SameSite=Lax cookies + synchronizer token + Origin check
app.use(cookieSession({ sameSite: 'lax', secure: true, httpOnly: true }));
app.use(csrfProtection);
Try it Yourself »
« Previous
Next »
Discussion
Loading…