Signed cookies and CSRF tokens

Cookies are stored in the browser, so visitors can edit them. With a secret configured for @fastify/cookie in jeasx.config.js, a route can set a cookie with { signed: true }: its value gets a signature, and request.unsignCookie() tells whether the value is still the one the server wrote.

A guard protects all forms of this example against cross-site request forgery: it stores a random token in a signed cookie and only accepts forms which send the same token in a hidden field. Have a look at the source to see how it works.

Notes

No notes cookie yet. Add a note to create one.

Try it

Changes the value like an attacker would, but keeps the signature.

Posts a form without CSRF token, like a forged form on another site.

Deletes the notes cookie.