Free CSRF Protection Checker

Nginx

# Harden cookies passing through the proxy so the browser
# refuses to send them on cross-site POSTs (nginx 1.19.3+).
proxy_cookie_flags ~ secure httponly samesite=lax;

# Token validation itself belongs in the application, not the proxy.

Apache

# Force SameSite + Secure on session cookies.
Header edit Set-Cookie ^(.*)$ "$1; SameSite=Lax; Secure; HttpOnly"

# Reject state-changing requests whose Origin is not ours.
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^(POST|PUT|PATCH|DELETE)$
RewriteCond %{HTTP:Origin} !^$
RewriteCond %{HTTP:Origin} !^https://example\.com$ [NC]
RewriteRule .* - [F]

Node.js (Express)

import express from "express"
import session from "express-session"

const app = express()

// Fail fast if the session secret is not configured.
const sessionSecret = process.env.SESSION_SECRET
if (!sessionSecret) throw new Error("SESSION_SECRET must be set")

// Without this, secure cookies are dropped when TLS terminates
// at a reverse proxy or load balancer in front of the app.
app.set("trust proxy", 1)

app.use(
  session({
    secret: sessionSecret,
    resave: false,
    saveUninitialized: false,
    cookie: { sameSite: "lax", secure: true, httpOnly: true },
  })
)

// Reject state-changing requests unless we can confirm a same-origin
// source. Fail closed: a missing Origin/Referer is treated as untrusted.
const ALLOWED_ORIGIN = "https://example.com"
function isSameOrigin(req) {
  // Origin is exact; compare it directly (no prefix matching, so
  // https://example.com.evil.com cannot slip through).
  if (req.headers.origin) return req.headers.origin === ALLOWED_ORIGIN
  // Fall back to Referer, comparing only its origin part.
  if (req.headers.referer) {
    try {
      return new URL(req.headers.referer).origin === ALLOWED_ORIGIN
    } catch {
      return false
    }
  }
  return false
}
app.use((req, res, next) => {
  if (["POST", "PUT", "PATCH", "DELETE"].includes(req.method) && !isSameOrigin(req)) {
    return res.sendStatus(403)
  }
  next()
})

// For per-request tokens on top of this, use a maintained library
// such as csrf-csrf. Avoid csurf - it is deprecated.