CSRF

CSRF

Prevent Cross-Site Request Forgery in state-changing operations.

What You Will Learn

• Core concepts and principles of CSRF
• How CSRF fits into the MERN backend stack
• Practical implementation patterns and best practices
• Common mistakes and how to avoid them

Prerequisites

Before diving into CSRF, make sure you understand the foundational concepts of Node.js and Express.js.

Why This Matters

Understanding CSRF is essential for building production-ready MERN backend applications. At Amazon, SDE-1 engineers are expected to implement these concepts correctly in backend services that handle millions of requests.

Key Concepts

CSRF is a fundamental building block in the MERN stack ecosystem. Mastering it enables you to build reliable, scalable backend systems.

Client Request
    |
    v
Express Router --> Middleware --> Controller --> Service --> Mongoose --> MongoDB
    |
    v
Response

Real-World Analogy

Think of CSRF like the foundation of a building. Just as a strong foundation supports the entire structure, understanding CSRF supports all the backend features you will build on top of it.

How CSRF Works

The Mechanism

CSRF operates as a core part of the MERN backend pipeline. Here is the flow:

1. Request arrives at the Express server
2. Middleware processes the request
3. Controller handles the business logic
4. Service layer interacts with the database
5. Response is sent back to the client

Request / Data Flow

HTTP Request
    |
    v
[Express Router] --> Route matching
    |
    v
[Middleware Chain] --> Authentication, Validation
    |
    v
[Controller] --> Request parsing, Response formatting
    |
    v
[Service] --> Business logic, Data transformation
    |
    v
[Repository/Mongoose] --> Database operations
    |
    v
[MongoDB] --> Data persistence
    |
    v
HTTP Response (JSON)

Visual Explanation

The MERN backend follows a layered architecture:

• Presentation Layer (Routes/Controllers): Handles HTTP requests and responses
• Business Logic Layer (Services): Implements application rules
• Data Access Layer (Repositories/Mongoose): Manages database interactions

Each layer has a single responsibility, making the code testable and maintainable.

Code Example

// Express route handler example
router.post('/api/users', validateRequest, async (req, res, next) => {
  try {
    const userData = req.body;
    const user = await userService.createUser(userData);
    res.status(201).json({ success: true, data: user });
  } catch (error) {
    next(error);
  }
});

Advantages

• Separation of concerns: Each layer handles one responsibility
• Testability: Layers can be tested independently
• Reusability: Services can be used across multiple controllers
• Maintainability: Changes in one layer do not affect others

Tradeoffs

• More files and folders to manage
• Initial setup takes longer than monolithic approaches
• Requires discipline to maintain proper layering

Implementing CSRF

Step-by-Step Guide

Step 1: Set up the project structure

src/
  controllers/
    userController.js
  services/
    userService.js
  models/
    User.js
  routes/
    userRoutes.js
  middleware/
    auth.js
    validate.js
  config/
    db.js
  app.js

Step 2: Define the model

const mongoose = require('mongoose');

const userSchema = new mongoose.Schema({
  name: { type: String, required: true },
  email: { type: String, required: true, unique: true },
  password: { type: String, required: true },
  role: { type: String, enum: ['user', 'admin'], default: 'user' }
}, { timestamps: true });

module.exports = mongoose.model('User', userSchema);

Step 3: Create the service

const User = require('../models/User');
const bcrypt = require('bcrypt');

class UserService {
  async createUser(userData) {
    const hashedPassword = await bcrypt.hash(userData.password, 10);
    const user = new User({ ...userData, password: hashedPassword });
    return user.save();
  }

  async findByEmail(email) {
    return User.findOne({ email });
  }
}

module.exports = new UserService();

Step 4: Create the controller

const userService = require('../services/userService');

exports.register = async (req, res, next) => {
  try {
    const existingUser = await userService.findByEmail(req.body.email);
    if (existingUser) {
      return res.status(409).json({ error: 'Email already registered' });
    }
    const user = await userService.createUser(req.body);
    res.status(201).json({ success: true, data: user });
  } catch (error) {
    next(error);
  }
};

Step 5: Define the route

const express = require('express');
const router = express.Router();
const userController = require('../controllers/userController');
const validate = require('../middleware/validate');

router.post('/register', validate(userSchema), userController.register);

module.exports = router;

JavaScript / TypeScript Example

// TypeScript version with interfaces
interface CreateUserDTO {
  name: string;
  email: string;
  password: string;
}

interface UserResponse {
  id: string;
  name: string;
  email: string;
  createdAt: Date;
}

async function createUser(dto: CreateUserDTO): Promise<UserResponse> {
  const hashedPassword = await bcrypt.hash(dto.password, 10);
  const user = await User.create({ ...dto, password: hashedPassword });
  return { id: user._id, name: user.name, email: user.email, createdAt: user.createdAt };
}

Common Mistakes

1. Putting business logic in controllers: Keep controllers thin
2. Skipping validation: Always validate input at the API boundary
3. Not handling errors: Always use try-catch or async error middleware
4. Hardcoding configuration: Use environment variables for all config

CSRF at Amazon

How Amazon Uses This

Amazon backend services rely heavily on the concepts covered in CSRF. As an SDE-1, you would:

• Build microservices that handle millions of requests per day
• Implement reliable APIs with proper error handling and validation
• Design for scalability and high availability
• Follow security best practices for data protection

Interview Relevance

In Amazon SDE-1 interviews, expect questions about:

1. Design: How would you design a backend service that uses CSRF?
2. Tradeoffs: What are the tradeoffs of different approaches?
3. Scalability: How would this scale to millions of users?
4. Debugging: How would you debug issues with CSRF in production?

STAR Method Example

Situation: Our team needed to implement CSRF for a new feature.
Task: I was responsible for designing and implementing the backend component.
Action: I used the layered architecture pattern with proper separation of concerns.
Result: The implementation handled 10K requests per second with 99.9% uptime.

Common Follow-up Questions

• How would you handle failures in this system?
• What monitoring would you add?
• How would you test this in staging before production?
• What would you do differently if starting over?