Free CSRF Protection Checker

Nginx

# Harden session cookie at the edge so the browser
# refuses to send it on cross-site POSTs.
proxy_cookie_path / "/; SameSite=Lax; Secure; HttpOnly";

# Reject cross-origin state-changing requests early.
map $request_method $is_state_change {
    default 0;
    POST    1;
    PUT     1;
    PATCH   1;
    DELETE  1;
}
map "$is_state_change:$http_origin" $csrf_block {
    default                       0;
    "~^1:$"                       1;
    "~^1:(?!https://example\.com).*$" 1;
}

server {
    if ($csrf_block) { return 403; }
}

Apache

# Force SameSite + Secure on session cookies.
Header edit Set-Cookie ^(.*)$ "$1; SameSite=Lax; Secure; HttpOnly"

# Block cross-origin state-changing requests at the vhost.
<If "%{REQUEST_METHOD} =~ /^(POST|PUT|PATCH|DELETE)$/">
  RewriteEngine On
  RewriteCond %{HTTP:Origin} !^$
  RewriteCond %{HTTP:Origin} !^https://example\.com$ [NC]
  RewriteRule .* - [F,L]
</If>

Node.js (Express + csurf)

import express from "express"
import cookieParser from "cookie-parser"
import csrf from "csurf"

const app = express()
app.use(cookieParser())

// Double-submit cookie strategy: token in HttpOnly cookie,
// echoed back via X-CSRF-Token header from the client.
const csrfProtection = csrf({
  cookie: {
    httpOnly: true,
    secure: true,
    sameSite: "lax",
  },
})

app.use(csrfProtection)

app.get("/csrf-token", (req, res) => {
  res.json({ csrfToken: req.csrfToken() })
})

// All POST/PUT/PATCH/DELETE routes now require a valid token.
app.post("/account/email", (req, res) => {
  res.json({ ok: true })
})