Dealing with CSRF attacks in JavaScript-based APIs and microservices

14 Sep 2023

Cross-Site Request Forgery (CSRF) attacks are a common security vulnerability that can affect JavaScript-based APIs and microservices. In this blog post, we will discuss what CSRF attacks are, how they can be exploited, and the steps you can take to protect your APIs and microservices against such attacks.

What is a CSRF Attack?

CSRF attacks occur when an attacker tricks a user into performing an unintended action on a website or web application where they are authenticated. The goal of the attacker is to forge a request on behalf of the user and carry out actions without their knowledge or consent. This can lead to unauthorized changes, data leakage, or even account takeover.

How are CSRF Attacks Exploited?

In a typical CSRF attack scenario, the attacker crafts a malicious website or sends a malicious link to the victim. When the victim visits the website or clicks the link while authenticated on another website, their browser automatically includes any cookies associated with the targeted website in the request. This allows the attacker to forge requests on behalf of the victim.

Protecting JavaScript-based APIs and Microservices

To protect your JavaScript-based APIs and microservices from CSRF attacks, you can implement the following measures:

CSRF Tokens: Generate and include CSRF tokens in each request that modifies data or performs sensitive actions. These tokens should be unique for each user session and validated by the server. The token can be stored in a cookie or included in the request headers.

Example code (using Node.js and Express.js):

app.use(bodyParser.urlencoded({ extended: true }));
app.use(cookieParser());
   
app.use((req, res, next) => {
  // Generate and set CSRF token
  const token = generateToken();
  res.cookie("csrfToken", token);
  req.csrfToken = token;
  next();
});
   
// Validate CSRF token in requests
app.post("/api/update", (req, res) => {
  if (req.csrfToken === req.cookies.csrfToken) {
    // Proceed with the request
  } else {
    // Invalid CSRF token, reject the request
  }
});

Same-Site Cookies: Set the SameSite attribute for your cookies to restrict their usage to the same origin. This prevents the browser from automatically including cookies in cross-site requests, mitigating CSRF attacks.

Example code (using Express.js setting SameSite attribute):
```
app.use(cookieParser());
   
app.use((req, res, next) => {
  res.setHeader("Set-Cookie", "sessionId=123; SameSite=Strict");
  next();
});
```
CORS (Cross-Origin Resource Sharing): Implement CORS on your APIs and microservices to explicitly define which origins are allowed to access resources. It helps to restrict cross-origin requests and adds an additional layer of protection against CSRF attacks.

Example code (using Express.js enabling CORS):
```
const cors = require("cors");
   
app.use(cors({
  origin: "https://trusted-website.com",
  methods: ["GET", "POST"],
  allowedHeaders: ["Content-Type", "Authorization"]
}));
```

Conclusion

CSRF attacks pose a significant threat to JavaScript-based APIs and microservices, but by implementing proper countermeasures like CSRF tokens, Same-Site cookies, and CORS, you can greatly reduce the risk of such attacks. It’s essential to stay vigilant and keep up with the latest security best practices to ensure the safety of your applications and their users.

#WebSecurity #CSRFProtection