Add CSRF Protection with AI Prompts

Add CSRF token protection to my application.

Framework: Next.js/Express/Django

Implementation:

1. Generate token on session creation
2. Store token server-side (in session)
3. Send token to client (cookie or response body)
4. Client includes token in requests
5. Server validates token matches session

For Express: npm install csurf app.use(csrf({ cookie: true }));

// Make token available to forms app.use((req, res, next) => { res.locals.csrfToken = req.csrfToken(); next(); });

For forms:

For AJAX: fetch('/api/endpoint', { method: 'POST', headers: { 'X-CSRF-Token': csrfToken }, body: JSON.stringify(data) })

Configure SameSite cookie attribute as CSRF defense.

SameSite options:

• Strict: Cookie only sent for same-site requests
• Lax: Sent for same-site + top-level navigation (default in modern browsers)
• None: Sent for all requests (requires Secure)

Recommended settings: // Session cookie Set-Cookie: session=abc123; SameSite=Lax; Secure; HttpOnly

// For APIs needing cross-site (use with caution) Set-Cookie: token=xyz; SameSite=None; Secure

For your framework:

Next.js (in API route): res.setHeader('Set-Cookie', session=${value}; Path=/; HttpOnly; Secure; SameSite=Lax );

Express: res.cookie('session', value, { httpOnly: true, secure: true, sameSite: 'lax' });

Note: SameSite alone isn't complete protection. Combine with CSRF tokens for defense in depth.

Add Origin/Referer header validation as additional CSRF defense.

Check these headers on state-changing requests:

1. Origin header (set by browser, can't be spoofed)
2. Referer header (fallback if Origin missing)

Implementation: function validateOrigin(req) { const origin = req.headers.origin || req.headers.referer;

if (!origin) { // Some browsers/privacy settings don't send these // Decide: reject or allow with token validation return false; }

const url = new URL(origin); const allowedOrigins = 'https://yourdomain.com', 'https://www.yourdomain.com' ;

return allowedOrigins.includes(url.origin); }

Apply to:

• POST, PUT, DELETE, PATCH requests
• Not GET or HEAD (should be read-only)

Use as additional check, not replacement for tokens.

Implement CSRF protection for my SPA/API architecture.

Pattern: Double Submit Cookie

1. Server sets CSRF token in cookie
2. JavaScript reads cookie, sends in header
3. Server compares cookie value to header value
4. Cross-origin requests can't read cookie to send header

Server (on login or session start): Set-Cookie: csrf_token=random123; Path=/; SameSite=Lax

Client (on each request): const csrfToken = document.cookie .split('; ') .find(c => c.startsWith('csrf_token=')) ?.split('=')1;

fetch('/api/action', { method: 'POST', headers: { 'X-CSRF-Token': csrfToken, 'Content-Type': 'application/json' }, body: JSON.stringify(data), credentials: 'include' });

Server validation: const cookieToken = req.cookies.csrf_token; const headerToken = req.headers'x-csrf-token'; if (cookieToken !== headerToken) { return res.status(403).json({ error: 'Invalid CSRF token' }); }