XSS & CSRF Protection

XSS prevention with Content Security Policy in TypeScript

import helmet from 'helmet';
import { Express } from 'express';

export function configureSecurityHeaders(app: Express): void {
  app.use(
    helmet.contentSecurityPolicy({
      directives: {
        defaultSrc: ["'self'"],
        scriptSrc: ["'self'", 'https://cdn.trusted.com'],
        styleSrc: ["'self'", "'unsafe-inline'"], // prefer hashes over unsafe-inline
        imgSrc: ["'self'", 'data:', 'https://images.example.com'],
        connectSrc: ["'self'", 'https://api.example.com', 'wss://ws.example.com'],
        fontSrc: ["'self'", 'https://fonts.gstatic.com'],
        objectSrc: ["'none'"],
        frameAncestors: ["'none'"],  // prevents clickjacking
        upgradeInsecureRequests: [],
      },
      reportOnly: false, // enforce, not just report
    })
  );
  app.use(helmet.xssFilter()); // X-XSS-Protection header for older browsers
}

CSP blocks injected scripts even if they reach the DOM by restricting which script sources are trusted. frameAncestors: 'none' replaces the deprecated X-Frame-Options header. Report-only mode allows CSP testing without breakage before enforcement.

CSRF protection in Rails with Authenticity Token

# Rails CSRF protection is enabled by default via ActionController::RequestForgeryProtection
# application_controller.rb
class ApplicationController < ActionController::Base
  # protect_from_forgery is included by default in Rails 5+
  # It uses :exception strategy (raises InvalidAuthenticityToken) by default
  protect_from_forgery with: :exception

  # For API endpoints that use JWT (no session cookie), CSRF is not applicable
  # Use :null_session to prevent CSRF checks for token-authenticated requests
  # protect_from_forgery with: :null_session, if: :json_request?
end

# Separate API controller that disables CSRF for Bearer token auth
class Api::BaseController < ActionController::API
  # ActionController::API does not include CSRF protection by default
  include ActionController::HttpAuthentication::Token::ControllerMethods

  before_action :authenticate_api_token!

  private

  def authenticate_api_token!
    authenticate_with_http_token do |token, _options|
      @current_user = ApiToken.active.find_by(token: token)&.user
    end
    render json: { error: 'Unauthorized' }, status: :unauthorized unless @current_user
  end
end

Rails embeds the CSRF token in forms via form_authenticity_token and validates it on non-GET requests. Modern SPA architectures using JWTs in HttpOnly cookies with SameSite=Strict are CSRF-immune because cross-site requests cannot read the cookie value.