So, I am trying to add CSRF protection to my Next.js application. I have tried a development branch of the next-csrf library. I have a couple of questions though:
- The library saves the CSRF token as a cookie. Is this secure? Isn't it vulnerable to session hijacks?
- Shall I refresh the token in every page? If I choose to do so, is there a point in saving the token as a cookie?
In general I am confused on whether the CSRF token should be a cookie or a HTTP header. Also, when shall I generate a new token?
Thanks for reading this!