I have an app with token-based authentication (stateless).

for specific endpoint that serves an pdf file, it was ideal for me to authenticate via cookie.

so I creates a cookie with my access token, with 1 second lifetime , just for the use of this endpoint:

// Set one-time cookie only for this action
Cookie.set("token", token, {
  secure: true,
  expires: new Date(Date.now() + 1000), // one second lifetime

// Open url
const newTab = window.open(

Do I need to implement csrf protection in this case? or it is safe enough ?...


1 Answer 1


CSRF requires user interaction to be exploited.

So unless you expect a user to access the attacker website within the 1 second period after executing your script, I wouldn't consider the likelihood of this attack very high.

So no, although CSRF is theoretically feasible, you can dismiss it with this justification.

On a side note, if there is another place in your code that sets the token cookie for a longer period, then you have a problem.

And in a more larger sense, you now have to be careful to not set this cookie anywhere in your code.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .