Firebase与Electron环境下会话Cookie配置的两处疑问咨询

Hey there! Let's tackle your two questions about configuring session cookies for your Electron app's Node backend using Firebase Admin:

1. Do I need to write the getCookie('csrfToken') function myself? #

Short answer: Yes, but it depends on your backend setup—you might not need to build a full custom function from scratch.

The getCookie call in Firebase's guide is just a placeholder to illustrate retrieving the CSRF token from cookies. In a real Node.js backend (like with Express), you’ll typically use a middleware like cookie-parser to automatically parse cookies from incoming requests into a req.cookies object.

For example, with Express:

1. Install the middleware:

   npm install cookie-parser
   

2. Add it to your app:

   const express = require('express');
   const cookieParser = require('cookie-parser');
   const app = express();
   app.use(cookieParser());
   

3. Grab the CSRF token directly from req.cookies instead of a custom function:

   const csrfToken = req.cookies.csrfToken;
   

If you’re using raw Node.js http without a framework, you’ll need to manually parse the Cookie header to extract the token—but using a framework/middleware simplifies this drastically.

2. How does the CSRF token check work, and should clients manually set req.cookies? #

Let’s break this into two clear parts:

The Anti-CSRF Principle #

CSRF (Cross-Site Request Forgery) attacks happen when a malicious site tricks a user’s browser into sending a request to your backend using the user’s existing authenticated session—browsers automatically attach cookies to requests, so the attack can impersonate the user.

The token check stops this by requiring two linked pieces of data:

• The CSRF token is stored in a cookie (sent automatically by the browser with every request to your domain)
• The same token is included in the request body or header (something malicious sites can’t access, thanks to the Same-Origin Policy—they can’t read cookies from your domain)

If the token in the request body doesn’t match the one in the cookie, your backend knows the request didn’t come from your trusted Electron app and rejects it.

Should clients manually set req.cookies? #

Absolutely not. req.cookies is a server-side object populated by your backend (usually via middleware like cookie-parser) from the Cookie header sent by the client.

What your client needs to do instead:

1. Retrieve the CSRF token from its own cookies (in Electron’s renderer process, use document.cookie to parse it)
2. Include this token in the request body (or a header like X-CSRF-Token) when sending the login request to your backend

Your backend then compares the token from the request body (e.g., req.body.csrfToken) with the one from req.cookies.csrfToken to confirm the request is legitimate.

内容的提问来源于stack exchange，提问作者sleigh_bells