The answer
With sameSite 'lax' or 'strict', CSRF is largely handled because cross-site requests do not include the cookie. For sameSite 'none' (third-party embeds), you need CSRF tokens (e.g., csurf middleware).
Cookie Security in Node.js Explained
Do I need CSRF tokens if I use sameSite cookies?
More FAQs in Cookie Security in Node.js Explained
httpOnly (no script access), secure (HTTPS only), sameSite ('lax' or 'strict' for CSRF protection), maxAge (match token expiry), domain (for subdomain sharing), path (for restriction), and signed (tamper detection with cookie-parser).
Scripts cannot read the cookie. Only the browser sends it on requests. Protects against XSS-driven cookie theft. Without httpOnly, any script (including injected ones) can read the cookie.
Controls when the cookie is sent on cross-site requests. 'strict' never sends it cross-site (strongest CSRF protection). 'lax' sends it on top-level navigations (good balance). 'none' always sends it (requires secure: true; use only for third-party embeds).
Still have questions?
Browse all our FAQs or reach out to our support team
Want to upskill yourself?
Your learning library
Small steps. Big possibilities.
Find your next course. Build something great.