Feature: Cross-Site Request Forgery (CSRF) Protection

[vivek0028]

📋 Description

This pull request implements Cross-Site Request Forgery (CSRF) protection for the CropChain API backend.

Most API endpoints use Authorization: Bearer tokens, which are generally not vulnerable to CSRF because browsers do not automatically attach Authorization headers to cross-origin requests. However, the authentication refresh token used by /api/auth/refresh is stored in an HttpOnly cookie.

Without CSRF protection, cookie-authenticated endpoints can potentially be abused through forged cross-origin requests. This implementation adds an additional security layer to protect the API against such attacks.

---

🚀 Key Changes

📦 Dependencies

Added the following dependencies to backend/package.json:

• csurf
• cookie-parser

🛡️ CSRF Middleware — backend/app.js

• Initialized cookie-parser.

• Added CSRF protection using csurf.

• Configured the CSRF cookie with:

  • httpOnly: true
  • sameSite: "strict"
  • secure: true in production

• Added a dedicated endpoint:

GET /api/csrf-token

This endpoint allows the frontend to obtain a CSRF token before making state-changing requests.

⚠️ CSRF Error Handling — backend/middleware/errorHandler.js

Added handling for the EBADCSRFTOKEN error.

Invalid or missing CSRF tokens now return:

403 Forbidden

with a clear response message:

Invalid or missing CSRF token

---

🔍 Security Impact

This implementation helps protect cookie-authenticated requests against:

• Cross-origin form submissions
• Forged AJAX requests
• Unauthorized state-changing operations
• CSRF attacks targeting authentication-related endpoints

The protection complements the existing JWT authentication and Helmet security headers.

---

🧪 Verification

• Added csurf dependency.
• Added cookie-parser.
• Configured CSRF middleware in backend/app.js.
• Added /api/csrf-token endpoint.
• Configured secure CSRF cookie attributes.
• Added EBADCSRFTOKEN error handling.
• Verified requests without X-CSRF-Token are rejected with 403 Forbidden.
• Verified requests with invalid CSRF tokens are rejected.
• Verified test environment bypass using NODE_ENV === "test" to avoid CI/test regressions.

---

⚠️ Frontend Integration Required

The frontend will need to be updated to work with the new CSRF protection.

Before making state-changing requests such as:

POST
PUT
PATCH
DELETE

the frontend should:

1. Request a CSRF token from:

GET /api/csrf-token

2. Include the returned token in the request header:

X-CSRF-Token: <csrf-token>

This ensures legitimate frontend requests pass CSRF validation.

Warning

This PR focuses on the backend implementation. Frontend integration is required for clients making protected state-changing requests.

---

📂 Files Changed

• backend/app.js
• backend/package.json
• backend/middleware/errorHandler.js

---

📌 Related Issue

Closes #1222

---

🏷️ Labels

enhancement security backend GSSoC'26

[vercel]

@vivek0028 is attempting to deploy a commit to the Nitya Gosain's projects Team on Vercel.

A member of the Team first needs to authorize it.