Loading published curriculum…

15 · Security / LESSON 74 OF 102

Sessions, CSRF, CORS, and tokens

Choose a security model intentionally.

Before this lesson: Password hashes and resource ownership

Understand the topic

Browsers attach cookies automatically, making CSRF protection relevant for cookie-authenticated mutations. CORS controls which origins may read browser responses; it is not authentication. Do not allow arbitrary credentialed origins.

Session login differs from bearer-token resource servers. OAuth2 Resource Server verifies tokens through a trusted issuer and validation policy; decoding a JWT is not verification. Keep the form-login model for the core course; add OAuth2 only as an extension.

EXAMPLE · HTTP

Authenticated request checklist

POST /api/tasks
Cookie: JSESSIONID=<your authenticated session>
Content-Type: application/json
X-CSRF-TOKEN: <token from your configured CSRF flow>

{"title":"Test secure creation"}

What to expect

Use the matching session and valid token. Missing/invalid tokens fail. Configure a token-delivery flow before connecting a SPA.

YOUR TURN

Put it into practice

  1. 01Document allowed frontend origins and methods.
  2. 02Test unauthenticated, missing-token, and wrong-owner requests.
  3. 03Explain why disabling CSRF is not a general CORS fix.

Pass a quiz or complete a lab to check today’s streak. Each lesson counts once per day, including when you review it later.

UNDER THE HOOD

Build the mental model

Browser security is a combination of transport, credential delivery, origin policy, and server-side authorization.

  1. 01Cookies can be attached to requests without the user deliberately authorizing the action. CSRF tokens bind unsafe requests to the application’s intended flow.
  2. 02CORS is enforced by browsers; curl is not blocked by CORS. The server must authenticate and authorize regardless of Origin headers.
  3. 03Bearer tokens must be cryptographically verified with issuer and audience policy. Expiry and key rotation need support; decoding JSON is not authentication.

A mistake worth avoiding

Do not store sensitive tokens in logs or embed them in URLs.

DEBUGGING ROOM

Something broke. Where do you look?

A frontend shows a CORS error, so someone proposes permitAll and disabling CSRF.

Before revealing the diagnosis, write down your first investigation step.

CHECK YOUR UNDERSTANDING

Does CORS stop a malicious non-browser client from calling an API?

Choose one answer

BUILD IT YOURSELF

Document a browser authentication flow

  1. 1.Choose session cookies or an OAuth2 resource-server model.
  2. 2.Document token/cookie acquisition and renewal.
  3. 3.Test allowed and disallowed origins separately from access permissions.

Acceptance checklist

Lab completion is your self-report. Knowledge checks do not certify project quality.

RETRIEVE IT FROM MEMORY

Why is decoding a JWT insufficient to trust it?

Revisit this lesson in three days after a successful check or lab.

Ready for the next step?

Explain when CSRF applies and how tokens differ from sessions.

Reading is separate from passing a knowledge check or completing a lab.

Go deeper · official references