Newbie - How are cookies involved in CSRF attacks?

• router

  3 837 4.7 JavaScript

  Router middleware for Koa. Maintained by @forwardemail and @ladjs. (by koajs)

  

The cookie part is crucial, but the CORS really depends on the implementation on bank.com. When sending an AJAX request to another domain, browsers first send a pre-flight OPTION request, to check the CORS rules on the destination domain. Only if the CORS works out will the browser send the "real" request. If bank.com implements a proper OPTION endpoint on /transfer that doesn't start any transfers, but just returns the CORS headers, the "real" transfer won't be called. It payes off to be redundant with security, so having both of these is good. If you're using Koa, koa-router has allowed methods to easily expose an OPTIONS endpoint for all other existing endpoints.

• SurveyJS

  surveyjs.io featured

  Open-Source JSON Form Builder to Create Dynamic Forms Right in Your App. With SurveyJS form UI libraries, you can build and style forms in a fully-integrated drag & drop form builder, render them in your JS app, and store form submission data in any backend, inc. PHP, ASP.NET Core, and Node.js.

  

Suggest a related project