The problem is, that the more I read about XSS and CSRF and the protection against these attacks for my website, the more I get confused what would be the right strategy.


  1. SPA (Reactjs and runs only in the browser desktop/mobile) served with NGINX (index.html) => https://example.com

    1.1 User Sign in/up is with Firebase Client SDK

  2. API Server https://example.com/api/... (Node.js + Express.js) which only allows JSON, runs on the same server as the SPA (runs socket.io where no critical operation are made => try to run it as wss) and should only allow request from website (NGINX forwards requests to localhost)

  3. Auth server (Node.js + Express.js) on https://auth.example.com uses Firebase Admin SDK to create session-cookie (have to write a custom Firebase sign in/up logic because Firebase does not support it) with ttl min-max. 24h, best would be if user has to login again when browser was closed, but if I set no cookie time I think this is against Firebase policy with max ttl of 2 weeks. CORS set because different domain and cookie created here and should be available on the main-domain.

Sign in/up flow was described by Firebase: client sign in in browser send token to server where I create the session and session-cookie is sent back to client.

Now with cookies set HttpOnly, I am or I should be secure from XSS, but my concern is now CSRF which is somehow much harder to understand and to get right.

My initial though would be to send a CSRF token when user visits the site for the first time (make GET request to auth server which sets the CSRF token in the Header) but then I think I run into a problem to verify the CSRF token in API server.

Also, I read somewhere here or stack-overflow that I would have a problem with CORS, because one can somehow make sub-domain request and all the CSRF protection is for naught. Some say to use a JWT token because with SPA you are not vulnerable against XSS etc. and secure against CSRF.

There are many answers out there, which sometimes are opposite of that what you just read few minutes ago.

How can I secure my setup against XSS and CSRF?

  • HttpOnly doesn't protect against XSS, it just prevents XSS from retrieving that cookie's value (which is of debatable importance to begin with, I'd call it borderline security theater in many cases, but potentially useful if cookies are storing actual data rather than a random session identifier). Single page apps are also not inherently secure against XSS and CSRF either. It sounds like either a lot of what you've read is wrong, or you haven't fully understood it. – AndrolGenhald Mar 4 at 14:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.