Build HTTP APIs with routing, middleware, validation, controllers, and error handling.
Lessons
Defend form and cookie flows against cross-site request forgery.
CSRF Protection is easiest to learn by reading the example, changing it, and observing the result.
// npm install csurf cookie-parser
import express from 'express';
import cookieParser from 'cookie-parser';
import csrf from 'csurf';
const app = express();
app.use(cookieParser());
app.use(csrf({ cookie: true }));
app.get('/form', (req, res) => res.json({ csrfToken: req.csrfToken() }));
app.post('/submit', (req, res) => res.json({ accepted: true }));
app.listen(3000);Practice the CSRF Protection example in a small scratch file, then explain what changed and why.