So, I am trying to add CSRF protection to my Next.js application. I have tried a development branch of the next-csrf library. I have a couple of questions though:

  1. The library saves the CSRF token as a cookie. Is this secure? Isn't it vulnerable to session hijacks?
  2. Shall I refresh the token in every page? If I choose to do so, is there a point in saving the token as a cookie?

In general I am confused on whether the CSRF token should be a cookie or a HTTP header. Also, when shall I generate a new token?

Thanks for reading this!

  • 2
    I just wrote a giant answer about CSRF, but in general: cookies can be used to provide server-stateless anti-CSRF values, but the actual value still needs to be in the body. Or you can use a custom header, in which case the value is usually irrelevant because the ability to set the header at all means the site is trusted. – CBHacking Apr 18 at 19:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.