Why should you care?

If refresh token or session cookie auto-sends, forged POST can transfer funds.

See it live — copy this example

Paste into your MeanVerse project (Angular + Express + MongoDB), then run with ng serve / node / mongosh as noted.

import csrf from 'csurf';
const csrfProtection = csrf({ cookie: { httpOnly: true, sameSite: 'strict' } });

router.get('/auth/csrf', csrfProtection, (req, res) => {
  res.json({ csrfToken: req.csrfToken() });
});

router.post('/transfers', csrfProtection, auth, createTransfer);

// Angular loads token then sends header
this.http.post('/api/transfers', body, {
  headers: { 'X-CSRF-Token': this.csrfToken }
});

What happened?

• Server sets CSRF secret cookie.
• Client fetches token and sends custom header — cross-origin forms cannot read token due to same-origin policy.

Practice next

1. Enable csurf on cookie-authenticated routes.
2. Angular service fetches CSRF on app init.
3. Use SameSite=Strict on auth cookies.
4. Switch sensitive ops to Authorization header only.
5. Verify CSRF fails without X-CSRF-Token in Postman test.

Remember

CSRF targets cookie-based auth. Double-submit cookie or synchronizer token pattern. SameSite cookies add modern browser layer.

Cookie session legacy

Older MeanVerse module uses session cookies for admin.

Outcome: CSRF tokens added; forged transfer POST blocked.