Cross-Site Request Forgery (CSRF)

CSRF exploits the fact that browsers automatically attach cookies to requests regardless of which site triggered them — a hidden form on evil.example can submit to your bank while you're still logged in.

Cookies are attached automatically by the browser, based on domain — not based on which page initiated the request

A CSRF token is a secret, unpredictable value the attacker's page has no way to read or guess

SameSite=Strict/Lax cookie flags stop cookies from being sent on many cross-site requests in the first place

State-changing requests (not simple reads) are the ones that need this protection most

Want this flow explained in detail as it plays?

POST/api/account/change-email

Headers

Host:app.flowground.dev

Content-Type:application/json

Cookie:session=eyJhbGciOi...redacted

Body

Stuck? Try a hint

Defense in depth

Revealed once you've worked through the hint ladder above — try the attack yourself first.

Vulnerable vs. Fixed

// DO NOT DO THIS
app.post("/api/account/change-email", (req, res) => {
  if (req.session.user) {
    updateEmail(req.session.user.id, req.body.newEmail); // cookie alone was enough
  }
});