🔗 CSRF protection in Phoenix with sec-fetch-site

Phoenix projects created with mix phx.new are protected from Cross-Site Request Forgery (CSRF) attacks by CSRF tokens.

While simple & effective, CSRF tokens have some annoying downsides:

• They have to be included in every ‘unsafe’ request (e.g. POST, PUT, DELETE, etc.)
• Tokens included in a page’s HTML must be masked as a countermeasure against BREACH
• Tokens become invalid if the user’s session expires or is cleared (e.g. on login/logout)

The good news is that since 2023, all major browsers send a Sec-Fetch-Site header with every request, which lets web servers determine whether the request is cross-origin.

Filippo Valsorda, Go cryptography maintainer, implemented Go v1.25’s CrossOriginProtection middleware using Sec-Fetch-Site and Origin headers. By reading through Filippo’s notes on how this middleware works and CrossOriginProtection’s source code, I was able to write a Sec-Fetch-Site based Plug for CSRF protection that I use in my Phoenix apps.