---
title: "Understanding CORS and CSRF"
canonical: "https://support.apollographql.com/space/ETKB/779452417/Understanding%20CORS%20and%20CSRF"
format: markdown
---
When securing web applications, two important concepts to understand are Cross-Origin Resource Sharing (CORS) and Cross-Site Request Forgery (CSRF). These mechanisms play distinct but complementary roles in safeguarding your site from various types of attacks.

#### What is CORS?

**Cross-Origin Resource Sharing (CORS)** is a security feature implemented by browsers to prevent malicious websites from making unauthorized requests to your server. It is a protocol that allows servers to specify who can access their resources by defining rules for cross-origin requests. CORS checks are performed by the browser and apply to non-simple requests, which are requests that do not meet certain criteria for simplicity (like `GET` or `POST` requests with specific headers).

- **Purpose**: CORS helps to ensure that resources on your server are only accessible by authorized domains.
- **Implementation**: Servers use CORS headers to specify which origins (domains) are permitted to access their resources. This is often done by setting the `Access-Control-Allow-Origin` header.

**Example CORS Configuration**:

```none
Access-Control-Allow-Origin: https://apollographql.com
```

In this example, only requests originating from `https://apollographql.com` are allowed.

#### What is CSRF?

**Cross-Site Request Forgery (CSRF)** is a type of attack where a malicious actor tricks a user into making unwanted requests to a different site where the user is authenticated. This can lead to actions being performed on behalf of the user without their consent.

- **Purpose**: CSRF attacks exploit the trust that a site has in the user's browser. They can be mitigated by ensuring that requests made to your site are intentionally generated by the user, not by malicious external sources.
- **Implementation**: CSRF protection often involves using tokens that must be included with state-changing requests (like form submissions) to verify their legitimacy.

**Example CSRF Token Usage**:

```
<form action="/update-profile" method="POST">
  <input type="hidden" name="csrf_token" value="random_token_here">
  <!-- Other form fields -->
</form>
```

#### How CORS and CSRF Work Together

- **CORS**: Handles whether the browser is allowed to make requests to a server from different origins. This is a browser-based security measure that only affects non-simple requests.
- **CSRF**: Prevents unauthorized commands from being transmitted from a user that the server trusts. It’s a server-side protection mechanism that ensures requests are made intentionally by the user.

#### Are CORS and CSRF Enough for Securing APIs?

While CORS and CSRF are essential for securing web applications, they alone might not be sufficient, especially for public APIs:

- **CORS Protection**: Properly configured CORS settings (e.g., a whitelist of allowed origins) can prevent unauthorized origins from making requests to your API. However, CORS alone does not guarantee that requests are genuinely coming from your site; it only prevents cross-origin requests from domains not specified in the `Access-Control-Allow-Origin` header.
- **CSRF Protection**: CSRF tokens are crucial for verifying that state-changing requests originate from an authenticated user and not from a malicious source. However, this protection is primarily relevant for requests that alter user data and may not be directly applicable to public APIs that do not require authentication.
- **Rate Limiting**: Implementing rate limiting helps to prevent abuse by controlling the number of requests from a single source. It is an effective way to mitigate scripted attacks and brute-force attempts.
- **Secure Authentication**: For APIs that require authentication, ensure that you have robust mechanisms in place for verifying and managing user credentials.

📕 Related Reading:

- [https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests)
- [https://www.apollographql.com/docs/apollo-server/security/cors/](https://www.apollographql.com/docs/apollo-server/security/cors/)