HTML MASTER CLASS /// LEARN TAGS /// BUILD STRUCTURE /// SEMANTIC WEB /// HTML MASTER CLASS /// LEARN TAGS ///

Untitled Lesson

⚡ Total XP: 0|💻 backend XP: 0

Skill Matrix

UNLOCK NODES BY LEARNING NEW TAGS.

Select an unlocked node to view details root

Pascual Vila

Frontend Instructor // Code Syllabus

Common Pitfalls & Errors

The Error //

Implementing a state-changing operation as a GET request

// Wrong: triggerable by a simple <img> tag anywhere
app.get("/account/delete", deleteAccount);

// Correct: requires a real form submission or fetch call
app.delete("/account", deleteAccount);

The Solution //

A GET request can be triggered automatically by an <img>, <link>, or <script> tag with zero user interaction — making any state-changing GET endpoint trivially exploitable via CSRF. All mutating operations must use POST, PUT, PATCH, or DELETE.

The Error //

Relying solely on CORS configuration to prevent CSRF

// CORS alone does NOT stop this classic CSRF vector:
<form action="https://victim-api.com/transfer" method="POST">...</form>
// The form submits regardless of CORS headers

The Solution //

CORS controls which origins can read a cross-origin response via JavaScript — it does not prevent a browser from sending a cross-origin request with cookies attached in the first place (like a plain HTML form submission), which is exactly the mechanism CSRF exploits. CORS and CSRF protection solve different problems and both are needed.