CSRF & XSS Prevention

# CSRF Token in form
<input type="hidden" name="csrf_token" value="token123">

# Verify token on server
if (req.body.csrf_token !== req.session.csrf_token) {
    throw new Error("Invalid token");
}

# SameSite cookie
Set-Cookie: sessionId=abc123; SameSite=Strict; Secure

# Custom header
X-CSRF-Token: token123

# Check Origin header
if (req.headers.origin !== "https://trusted.com") {
    return res.status(403).send();
}

# Escape HTML output
function escapeHtml(text) {
    const map = {
        '&': '&',
        '<': '&lt;',
        '>': '&gt;'
    };
    return text.replace(/[&<>]/g, c => map[c]);
}

# CSP header
Content-Security-Policy:
    default-src 'self';
    script-src 'self' 'unsafe-inline';
    style-src 'self' 'unsafe-inline';
    img-src 'self' data:

# Safe - JSX escapes by default
{userInput}

# Unsafe - dangerouslySetInnerHTML


# Safe alternative - sanitize
import DOMPurify from "dompurify";
const clean = DOMPurify.sanitize(userInput);