Node Cookbook - Third Edition

Getting ready

We're going to create a simple server that manages "Employee Payment Profile" updates, and an adversarial server that uses CSRF to change where an employee's hypothetical salary is sent.

To demonstrate cross domain interaction locally, we need to simulate domains on our host machine, we can use the devurl tool, let's install it like so:

$ npm install -g devurl 

Let's begin with the target server, we'll create a folder called app, initialize it as a package, install express, express-session and body-parser and he, and create an index.js file:

$ mkdir app$ cd app$ npm init -y$ npm install express express-session body-parser he$ touch index.js

Our app/index.js should look as follows:

const express = require('express')const bodyParser ...