Secure Your Node.js Web Application

Wrapping Up

In this chapter we studied CSRF, and you learned how this attack can be used to target your website. It’s a dangerous attack vector because the attacker can use a different website or social engineering to perform different functions on the site. We also covered token- and header-based defenses, which can be very effective. But you saw how these methods turn out to be useless if you don’t address XSS issues first.

We’ve looked at a lot of ways you can secure your code. In the next chapter, we’ll look at how you can also secure your and your clients’ data.

Footnotes

[79]

https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS

[80]

https://github.com/expressjs/csurf

[81]

https://en.wikipedia.org/wiki/BREACH_(security_exploit) ...