In this study, CSRF prevention and authentication with JWT are implemented with a simple example regardless of database and front-end implementations. HTTP requests were handled through Postman.

• Sign out function and token invalidation has been added.

nodemon: A tool that helps develop node.js based applications by restarting automatically the application when file changes are detected in the directory.

csurf: A Node.js middleware that is used to prevent CSRF attacks. (Note: Note: This module has been deprecated since September 2022 due to the security vulnerability reports. https://github.com/expressjs/csurf)

dotenv: A module for environmental configuration variables.

express: A backend web application framework for Node.js.

express-session: A session middleware for Express.

jsonwebtoken: An implementation of JWT for Node.js.

node-cache: A simple caching module for Node.js that has set, get and delete methods.

There should be a .env file in ./backend and its variables are;

DOMAIN
PORT
CSRFT_SESSION_SECRET
JWT_SECRET
#jwt and csrf token expires in milliseconds
CSRFT_EXPIRESIN
JWT_EXPIRESIN
JWT_REFRESH_EXPIRESIN

Authentication credentials are not required. They were given manually in the code.

const user = {
    "_id": "someId123", "email": "[email protected]"
} // user data is assigned manually for testing.

cd backend
npm install

npm run start:dev