XSS and CSRF Protection

20 min read

Quick Overview

Cross-Site Scripting (XSS) happens when attacker-controlled text is rendered as HTML/JavaScript instead of inert data; Cross-Site Request Forgery (CSRF) happens when another origin makes the user’s browser send an authenticated request your server trusts. In TypeScript you lean on React’s auto-escaping and a CSRF middleware; in Rust you get the same defenses — auto-escaping templates (askama), CSRF tokens, SameSite cookies, and a Content-Security-Policy header — but assembled from small, explicit, compile-checked pieces. This file shows how each TypeScript habit maps onto an idiomatic, current Rust web stack (axum 0.8 + askama 0.16).

Note: The toolchain here is Rust 1.96.0 on the latest stable edition (2024), which cargo new selects automatically. Every Rust snippet below was compiled and run; the outputs are real.

TypeScript/JavaScript Example

A typical Express handler that renders user-submitted comments and protects a form with a CSRF token. The bug-prone version is shown first, then the safe version.

1
import express from "express";
2
import cookieParser from "cookie-parser";
3
import crypto from "node:crypto";
4

5
const app = express();
6
app.use(express.urlencoded({ extended: true }));
7
app.use(cookieParser());
8

9
// XSS: interpolating raw user input straight into HTML.
10
app.get("/unsafe", (req, res) => {
11
  const name = String(req.query.name ?? "");
12
  res.send(`<h1>Hello, ${name}</h1>`); // ?name=<script>steal()</script> runs!
13
});
14

15
// Escape on output. (React/JSX does this for you; raw string templates do not.)
16
function escapeHtml(s: string): string {
17
  const map: Record<string, string> = {
18
    "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#x27;",
19
  };
20
  return s.replace(/[&<>"']/g, (c) => map[c]);
21
}
22

23
app.get("/safe", (req, res) => {
24
  const name = escapeHtml(String(req.query.name ?? ""));
25
  res.send(`<h1>Hello, ${name}</h1>`);
26
});
27

28
// CSRF: double-submit cookie + hidden field, compared in constant time.
29
app.get("/form", (req, res) => {
30
  const token = crypto.randomBytes(32).toString("base64url");
31
  res.cookie("csrf_token", token, {
32
    httpOnly: true,
33
    secure: true,
34
    sameSite: "strict",
35
    path: "/",
36
  });
37
  res.send(
38
    `<form method="post" action="/submit">
39
       <input type="hidden" name="csrf_token" value="${token}">
40
       <input name="message"><button>Send</button>
41
     </form>`,
42
  );
43
});
44

45
app.post("/submit", (req, res) => {
46
  const cookieToken = String(req.cookies.csrf_token ?? "");
47
  const formToken = String(req.body.csrf_token ?? "");
48
  const a = Buffer.from(cookieToken);
49
  const b = Buffer.from(formToken);
50
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
51
    return res.status(403).send("CSRF validation failed");
52
  }
53
  res.send(`Accepted: ${escapeHtml(String(req.body.message ?? ""))}`);
54
});

Running the escapeHtml helper on Node v22:

1
raw:     <script>alert('xss')</script>
2
escaped: &lt;script&gt;alert(&#x27;xss&#x27;)&lt;/script&gt;

The shape is familiar: escape on output, issue a CSRF token, set SameSite cookies, compare tokens in constant time. The Rust version keeps every one of those ideas — it just makes the escaping the default instead of something you must remember.

Rust Equivalent

The idiomatic Rust stack uses askama for auto-escaping templates and axum + axum-extra for cookies and middleware. Add the dependencies in a fresh project:

1
cargo new comment-app && cd comment-app
2
cargo add axum
3
cargo add tokio --features full
4
cargo add axum-extra --features cookie
5
cargo add askama
6
cargo add getrandom
7
cargo add subtle
8
cargo add base64
9
cargo add serde --features derive

First, output encoding. Put a template in templates/comment.html:

1
<article class="comment">
2
  <h3>{{ author }}</h3>
3
  <p>{{ body }}</p>
4
</article>

1
use askama::Template;
2

3
#[derive(Template)]
4
#[template(path = "comment.html")]
5
struct CommentTemplate<'a> {
6
    author: &'a str,
7
    body: &'a str,
8
}
9

10
fn main() {
11
    let tpl = CommentTemplate {
12
        author: "Mallory",
13
        // Attacker-supplied content that would be an XSS payload if injected raw:
14
        body: "<script>steal(document.cookie)</script>",
15
    };
16
    let html = tpl.render().unwrap();
17
    println!("{html}");
18
}

Real output — note that the <script> was neutralized without any escaping call in your code:

1
<article class="comment">
2
  <h3>Mallory</h3>
3
  <p>&#60;script&#62;steal(document.cookie)&#60;/script&#62;</p>
4
</article>

Second, CSRF protection with a SameSite cookie, a Content-Security-Policy header, and constant-time token comparison — a complete axum app:

1
use axum::{
2
    extract::{Form, Request},
3
    http::{header, HeaderValue, StatusCode},
4
    middleware::{self, Next},
5
    response::{Html, IntoResponse, Response},
6
    routing::{get, post},
7
    Router,
8
};
9
use axum_extra::extract::cookie::{Cookie, CookieJar, SameSite};
10
use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
11
use serde::Deserialize;
12
use subtle::ConstantTimeEq;
13

14
const CSRF_COOKIE: &str = "csrf_token";
15

16
/// 32 random bytes (256 bits) from the OS CSPRNG, URL-safe base64.
17
fn generate_csrf_token() -> String {
18
    let mut bytes = [0u8; 32];
19
    getrandom::fill(&mut bytes).expect("OS RNG failed");
20
    URL_SAFE_NO_PAD.encode(bytes)
21
}
22

23
/// Constant-time string comparison — never use `==` on secrets.
24
fn tokens_match(a: &str, b: &str) -> bool {
25
    let (a, b) = (a.as_bytes(), b.as_bytes());
26
    a.len() == b.len() && bool::from(a.ct_eq(b))
27
}
28

29
async fn show_form(jar: CookieJar) -> impl IntoResponse {
30
    let token = generate_csrf_token();
31
    let cookie = Cookie::build((CSRF_COOKIE, token.clone()))
32
        .http_only(true)
33
        .secure(true)
34
        .same_site(SameSite::Strict)
35
        .path("/")
36
        .build();
37
    let body = format!(
38
        r#"<form method="post" action="/submit">
39
  <input type="hidden" name="csrf_token" value="{token}">
40
  <input name="message"><button>Send</button>
41
</form>"#
42
    );
43
    (jar.add(cookie), Html(body))
44
}
45

46
#[derive(Deserialize)]
47
struct SubmitForm {
48
    csrf_token: String,
49
    message: String,
50
}
51

52
async fn submit(jar: CookieJar, Form(form): Form<SubmitForm>) -> Response {
53
    match jar.get(CSRF_COOKIE).map(|c| c.value().to_owned()) {
54
        Some(ct) if tokens_match(&ct, &form.csrf_token) => {
55
            Html(format!("Accepted: {}", form.message)).into_response()
56
        }
57
        _ => (StatusCode::FORBIDDEN, "CSRF validation failed").into_response(),
58
    }
59
}
60

61
/// Middleware adding a strict Content-Security-Policy to every response.
62
async fn add_csp(request: Request, next: Next) -> Response {
63
    let mut response = next.run(request).await;
64
    response.headers_mut().insert(
65
        header::CONTENT_SECURITY_POLICY,
66
        HeaderValue::from_static(
67
            "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'",
68
        ),
69
    );
70
    response
71
}
72

73
fn app() -> Router {
74
    Router::new()
75
        .route("/form", get(show_form))
76
        .route("/submit", post(submit))
77
        .layer(middleware::from_fn(add_csp))
78
}
79

80
#[tokio::main]
81
async fn main() {
82
    let listener = tokio::net::TcpListener::bind("127.0.0.1:3000").await.unwrap();
83
    axum::serve(listener, app()).await.unwrap();
84
}

Exercised end-to-end against a running instance, the responses are:

1
CSP header: default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'
2
Set-Cookie: csrf_token=0hGesYorQSmkT5ocqggUAmV9BzUAqPCJsmWsOdKzOuI; HttpOnly; SameSite=Strict; Secure; Path=/
3
valid token  -> 200 OK
4
forged token -> 403 Forbidden

A request with a matching cookie + form token returns 200; a forged form token returns 403 — and every response carries the CSP header.

Detailed Explanation

Output encoding (XSS defense)

XSS is fundamentally a context confusion bug: data crosses into a code context (HTML, JS, an attribute, a URL) without being neutralized for that context. The fix is contextual output encoding — escape the bytes that are special in the destination context, at the moment you render.

In the askama example, #[derive(Template)] + #[template(path = "...")] generates a render() method at compile time. Askama detects from the .html extension that the output is HTML and auto-escapes every {{ ... }} expression by default. The <script> became <script> with zero escaping code on your side. This mirrors how React/JSX escapes {value} automatically.

render() returns Result<String, askama::Error>. In a handler you render to a String and wrap it in axum’s Html(...), which sets Content-Type: text/html; charset=utf-8:

1
use askama::Template;
2
use axum::{http::StatusCode, response::{Html, IntoResponse, Response}};
3

4
#[derive(Template)]
5
#[template(path = "page.html")]
6
struct Page { title: String }
7

8
async fn handler() -> Response {
9
    let page = Page { title: "<b>hi</b>".into() };
10
    match page.render() {
11
        Ok(html) => Html(html).into_response(),
12
        Err(_) => StatusCode::INTERNAL_SERVER_ERROR.into_response(),
13
    }
14
}

With templates/page.html containing <h1>{{ title }}</h1>, this renders <b>hi</b> as <h1><b>hi</b></h1> — escaped, with no escaping call in handler.

When you don’t use a template engine, escape manually with a tiny helper (this is what askama does internally):

1
fn escape_html(input: &str) -> String {
2
    let mut out = String::with_capacity(input.len());
3
    for c in input.chars() {
4
        match c {
5
            '&' => out.push_str("&amp;"),
6
            '<' => out.push_str("&lt;"),
7
            '>' => out.push_str("&gt;"),
8
            '"' => out.push_str("&quot;"),
9
            '\'' => out.push_str("&#x27;"),
10
            _ => out.push(c),
11
        }
12
    }
13
    out
14
}
15

16
fn main() {
17
    let attacker = r#"<script>alert('xss')</script>"#;
18
    println!("raw:     {attacker}");
19
    println!("escaped: {}", escape_html(attacker));
20
}

Real output:

1
raw:     <script>alert('xss')</script>
2
escaped: &lt;script&gt;alert(&#x27;xss&#x27;)&lt;/script&gt;

Prefer a library (askama, v_htmlescape, askama_escape) for hot paths — they SIMD-accelerate the scan — but understanding the five-character core (& < > " ') is what matters.

CSRF protection

CSRF exploits ambient authority: the browser auto-attaches the session cookie to any request to your origin, including a form auto-submitted from evil.com. Two layers defeat it, and you want both:

SameSite cookies. same_site(SameSite::Strict) tells the browser to omit the cookie on cross-site requests entirely. SameSite::Lax (the modern browser default for cookies without an explicit attribute) sends the cookie on top-level GET navigations but not on cross-site POSTs — usually the right choice for session cookies, because Strict breaks “follow a link into the app while logged in.” This is your first, mostly-free line of defense.
A CSRF token. A random value the server issues and the form echoes back. The double-submit cookie pattern (shown above) stores the token in a cookie and a hidden field; on POST you require them to match. An attacker on another origin can’t read your cookie (Same-Origin Policy) and can’t guess a 256-bit value, so they can’t forge the field.

Walking the Rust handler:

getrandom::fill(&mut bytes) fills the buffer from the operating-system CSPRNG (getrandom(2) / BCryptGenRandom), never a seeded or predictable generator. Token unpredictability is the whole game. See Secure Randomness for why getrandom/OsRng and not a fast non-cryptographic PRNG.
URL_SAFE_NO_PAD.encode(bytes) turns 32 bytes into a 43-character URL/cookie-safe string.
tokens_match uses subtle::ConstantTimeEq. A naive cookie_token == form_token returns early on the first differing byte, leaking how many leading bytes matched through timing — enough, in theory, to recover a token byte-by-byte. ct_eq examines every byte unconditionally and returns a subtle::Choice, converted to bool with bool::from(...). (Check the length before the constant-time compare; length isn’t secret.)
CookieJar is an axum extractor: jar.get(...) reads an incoming cookie, and returning jar.add(cookie) from the handler emits the Set-Cookie header. The handler returns the tuple (jar, Html(body)) because a leading CookieJar in a response tuple writes the cookies.

Content-Security-Policy (defense in depth)

A CSP is a server-set HTTP header that tells the browser which sources of script, style, images, etc. are allowed — a backstop that limits the damage even if an XSS slips past your encoding. script-src 'self' blocks inline <script> and third-party scripts; object-src 'none' kills Flash/<object> vectors; frame-ancestors 'none' is the modern replacement for X-Frame-Options that prevents clickjacking. The add_csp middleware (middleware::from_fn) runs on every response via .layer(...), the same way you’d add an Express middleware with app.use(...).

Key Differences

Concern	TypeScript / Node	Rust (axum + askama)
Default escaping	React/JSX escapes; raw template strings do not	askama `{{ }}` auto-escapes by default for `.html`
Opting out (raw HTML)	`dangerouslySetInnerHTML`	the `\|safe` filter — both are loud, deliberate opt-outs
When escaping is decided	Runtime, per render call	Compile time — escaping code is generated by the macro
Secure randomness	`crypto.randomBytes`	`getrandom::fill` / `OsRng` (OS CSPRNG)
Constant-time compare	`crypto.timingSafeEqual`	`subtle::ConstantTimeEq::ct_eq`
Cookie attributes	object: `{ httpOnly, secure, sameSite }`	builder: `.http_only(true).secure(true).same_site(...)`
CSP / security headers	`helmet` middleware	`tower-http` `SetResponseHeaderLayer` or `from_fn`
Type safety of responses	strings; mistakes are runtime	`IntoResponse`; many mistakes are compile errors

The deepest difference: in Rust, escaping is the default and the unsafe path is named and visible. In a raw JS template literal the safe path is the one you must remember (escapeHtml(...)); forget it and you ship an XSS. With askama you must type extra characters (|safe) to become unsafe, which is exactly backwards from string templating — in the secure direction.

Note: Rust gives you no magic immunity here. A web server that builds HTML with format! and serves it via Html(format!("<h1>{name}</h1>")) is just as vulnerable as the Express /unsafe route — it compiles fine. Memory safety and type safety do not prevent injection; encoding does.

Common Pitfalls

Pitfall 1: Bypassing auto-escaping with `|safe`

Askama’s |safe filter (and the Safe/Html markers) emit a value without escaping. Given templates/raw.html:

1
<div>{{ body|safe }}</div>

1
use askama::Template;
2

3
#[derive(Template)]
4
#[template(path = "raw.html")]
5
struct RawTemplate<'a> {
6
    body: &'a str,
7
}
8

9
fn main() {
10
    let tpl = RawTemplate {
11
        body: "<b>trusted</b> but <script>alert(1)</script> sneaks through",
12
    };
13
    println!("{}", tpl.render().unwrap());
14
}

Real output — the <script> is not escaped:

1
<div><b>trusted</b> but <script>alert(1)</script> sneaks through</div>

Only use |safe on HTML you produced and already sanitized (e.g., output of a Markdown renderer run through the ammonia HTML-sanitizer crate). Never on raw user input.

Pitfall 2: Building HTML with `format!` and serving it raw

This compiles and runs — and is a textbook XSS:

1
use axum::response::Html;
2

3
async fn greet(name: String) -> Html<String> {
4
    // Vulnerable: `name` is interpolated unescaped. Same bug as the Node /unsafe route.
5
    Html(format!("<h1>Hello, {name}</h1>"))
6
}

This compiles cleanly — the danger is silent.

The compiler is happy because there’s no type error — only a security error. Route HTML through askama or your escape_html helper instead.

Pitfall 3: Comparing tokens with `==`

1
fn tokens_match(cookie: &str, form: &str) -> bool {
2
    cookie == form // early-exit comparison: leaks match length via timing
3
}
4

5
fn main() {
6
    let _ = tokens_match("a", "b");
7
}

This compiles and seems correct, but == on &str/[u8] returns as soon as bytes differ, exposing a timing side channel. Use subtle::ConstantTimeEq::ct_eq as shown earlier.

Pitfall 4: Returning mismatched response types from a handler

A real compiler error you will hit when a handler’s branches return different types:

1
use axum::{
2
    http::StatusCode,
3
    response::{Html, Response},
4
};
5

6
async fn handler(ok: bool) -> Response {
7
    if ok {
8
        Html("<p>ok</p>")             // does not compile (E0308)
9
    } else {
10
        (StatusCode::FORBIDDEN, "no")
11
    }
12
}
13

14
fn main() {
15
    let _ = handler;
16
}

The actual rustc message:

1
error[E0308]: mismatched types
2
 --> src/main.rs:8:9
3
  |
4
6 | async fn handler(ok: bool) -> Response {
5
  |                               -------- expected `Response<Body>` because of return type
6
7 |     if ok {
7
8 |         Html("<p>ok</p>")             // does not compile (E0308)
8
  |         ^^^^^^^^^^^^^^^^^ expected `Response<Body>`, found `Html<&str>`
9
  |
10
  = note: expected struct `Response<Body>`
11
             found struct `Html<&str>`

Fix it by calling .into_response() on each arm so both unify to Response — that is why the CSRF handler above does exactly that. This is annoying at first but valuable: the type system forces you to think about what every branch actually sends.

Pitfall 5: Forgetting `secure` / `http_only` on cookies

SameSite alone is not enough. A CSRF/session cookie should also be HttpOnly (so XSS-injected JS can’t read it) and Secure (so it’s never sent over plain HTTP and can’t be stolen on the wire). Set all three together, as in show_form.

Best Practices

Encode at output, in the right context. Use askama (or another auto-escaping engine) so HTML escaping is the default. Reserve |safe for content you sanitized yourself.
Never build HTML by string concatenation with user data. If you must, run every interpolated value through an escaper for its exact context (HTML body vs. attribute vs. URL vs. JS differ).
Sanitize rich HTML with ammonia. When users legitimately submit HTML (Markdown comments, WYSIWYG), render to HTML then pass it through ammonia::clean(...) to strip scripts and event handlers — then |safe is acceptable.
Layer CSRF defenses. SameSite=Lax for session cookies plus a per-session/per-request CSRF token for state-changing routes. For pure JSON APIs called from your own SPA with a custom header (e.g., Authorization: Bearer), CSRF risk is low because cross-site requests can’t set custom headers without a CORS preflight — but cookie-authenticated endpoints still need tokens.
Generate tokens from the OS CSPRNG (getrandom/OsRng), ≥ 128 bits, and compare with subtle. See Secure Randomness.
Ship a Content-Security-Policy as defense in depth. Prefer tower-http’s SetResponseHeaderLayer for static headers or middleware::from_fn for per-request nonces. Also set X-Content-Type-Options: nosniff and Referrer-Policy.
Set cookies HttpOnly + Secure + SameSite every time. For tamper-proof cookies, use axum-extra’s SignedCookieJar or PrivateCookieJar.
Validate inputs at the boundary so malformed data never reaches your renderer — see Input Validation. XSS defense (encoding) and input validation are complementary, not interchangeable: validate on input, encode on output.

Real-World Example

A small “guestbook” service: it stores comments, renders them with auto-escaping, protects the POST with a CSRF token, and sends a CSP header — the production-flavored version of the snippets above. Dependencies:

1
cargo add axum
2
cargo add tokio --features full
3
cargo add axum-extra --features cookie
4
cargo add askama
5
cargo add getrandom subtle base64
6
cargo add serde --features derive

templates/guestbook.html:

1
<!doctype html>
2
<title>Guestbook</title>
3
<ul>
4
{% for c in comments %}
5
  <li><strong>{{ c.author }}</strong>: {{ c.body }}</li>
6
{% endfor %}
7
</ul>
8
<form method="post" action="/comments">
9
  <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
10
  <input name="author" placeholder="name">
11
  <input name="body" placeholder="comment">
12
  <button>Post</button>
13
</form>

src/main.rs:

1
use std::sync::{Arc, Mutex};
2

3
use askama::Template;
4
use axum::{
5
    extract::{Form, Request, State},
6
    http::{header, HeaderValue, StatusCode},
7
    middleware::{self, Next},
8
    response::{Html, IntoResponse, Response},
9
    routing::get,
10
    Router,
11
};
12
use axum_extra::extract::cookie::{Cookie, CookieJar, SameSite};
13
use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
14
use serde::Deserialize;
15
use subtle::ConstantTimeEq;
16

17
const CSRF_COOKIE: &str = "csrf_token";
18

19
#[derive(Clone)]
20
struct Comment {
21
    author: String,
22
    body: String,
23
}
24

25
type AppState = Arc<Mutex<Vec<Comment>>>;
26

27
#[derive(Template)]
28
#[template(path = "guestbook.html")]
29
struct GuestbookTemplate {
30
    comments: Vec<Comment>,
31
    csrf_token: String,
32
}
33

34
fn new_token() -> String {
35
    let mut bytes = [0u8; 32];
36
    getrandom::fill(&mut bytes).expect("OS RNG failed");
37
    URL_SAFE_NO_PAD.encode(bytes)
38
}
39

40
fn tokens_match(a: &str, b: &str) -> bool {
41
    let (a, b) = (a.as_bytes(), b.as_bytes());
42
    a.len() == b.len() && bool::from(a.ct_eq(b))
43
}
44

45
async fn index(State(state): State<AppState>, jar: CookieJar) -> impl IntoResponse {
46
    let token = new_token();
47
    let cookie = Cookie::build((CSRF_COOKIE, token.clone()))
48
        .http_only(true)
49
        .secure(true)
50
        .same_site(SameSite::Strict)
51
        .path("/")
52
        .build();
53

54
    let comments = state.lock().unwrap().clone();
55
    let page = GuestbookTemplate { comments, csrf_token: token };
56
    match page.render() {
57
        Ok(html) => (jar.add(cookie), Html(html)).into_response(),
58
        Err(_) => StatusCode::INTERNAL_SERVER_ERROR.into_response(),
59
    }
60
}
61

62
#[derive(Deserialize)]
63
struct NewComment {
64
    csrf_token: String,
65
    author: String,
66
    body: String,
67
}
68

69
async fn add_comment(
70
    State(state): State<AppState>,
71
    jar: CookieJar,
72
    Form(form): Form<NewComment>,
73
) -> Response {
74
    let valid = jar
75
        .get(CSRF_COOKIE)
76
        .map(|c| tokens_match(c.value(), &form.csrf_token))
77
        .unwrap_or(false);
78

79
    if !valid {
80
        return (StatusCode::FORBIDDEN, "CSRF validation failed").into_response();
81
    }
82

83
    // Note: author/body are stored RAW and only escaped at render time by askama.
84
    state.lock().unwrap().push(Comment {
85
        author: form.author,
86
        body: form.body,
87
    });
88
    (StatusCode::SEE_OTHER, [(header::LOCATION, "/")]).into_response()
89
}
90

91
async fn add_security_headers(request: Request, next: Next) -> Response {
92
    let mut response = next.run(request).await;
93
    let headers = response.headers_mut();
94
    headers.insert(
95
        header::CONTENT_SECURITY_POLICY,
96
        HeaderValue::from_static(
97
            "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'",
98
        ),
99
    );
100
    headers.insert(
101
        header::X_CONTENT_TYPE_OPTIONS,
102
        HeaderValue::from_static("nosniff"),
103
    );
104
    response
105
}
106

107
#[tokio::main]
108
async fn main() {
109
    let state: AppState = Arc::new(Mutex::new(Vec::new()));
110
    let app = Router::new()
111
        .route("/", get(index))
112
        .route("/comments", axum::routing::post(add_comment))
113
        .layer(middleware::from_fn(add_security_headers))
114
        .with_state(state);
115

116
    let listener = tokio::net::TcpListener::bind("127.0.0.1:3000").await.unwrap();
117
    println!("guestbook on http://127.0.0.1:3000");
118
    axum::serve(listener, app).await.unwrap();
119
}

Every comment posted with <script> in the body is stored verbatim but rendered escaped (because askama escapes {{ c.body }}), so it can never execute. Every state-changing POST is gated on a CSRF token bound to a SameSite=Strict cookie, and every response carries a CSP. That is the same defense-in-depth posture you’d build with helmet + a CSRF middleware in Express, expressed in types the compiler checks for you.

Tip: In a real deployment put this behind TLS (see TLS/SSL with rustls) — Secure cookies require HTTPS — and store comments in a database with parameterized queries (see SQL Injection Prevention).

Exercises

Exercise 1: Per-request CSP nonce

Difficulty: Beginner

Objective: Generate a cryptographically random Content-Security-Policy nonce so you can allow specific inline scripts while keeping script-src locked down.

Instructions: Write a function csp_nonce() -> String that produces 16 random bytes from the OS CSPRNG and encodes them as standard base64. Print a script-src directive that uses it and a matching <script nonce="..."> tag. (In a real app the same nonce goes in both the header and every inline <script> tag for that response.)

Solution

1
use base64::{engine::general_purpose::STANDARD, Engine as _};
2

3
/// Generate a per-request CSP nonce: 16 random bytes, standard base64.
4
/// Use it in BOTH the CSP header (`script-src 'nonce-...'`) and the matching
5
/// `<script nonce="...">` tags so only your inline scripts execute.
6
fn csp_nonce() -> String {
7
    let mut bytes = [0u8; 16];
8
    getrandom::fill(&mut bytes).expect("OS RNG failed");
9
    STANDARD.encode(bytes)
10
}
11

12
fn main() {
13
    let nonce = csp_nonce();
14
    println!("script-src 'self' 'nonce-{nonce}'");
15
    println!("<script nonce=\"{nonce}\">/* inline */</script>");
16
}

Real output (the nonce changes every run — that is the point):

1
script-src 'self' 'nonce-YayonlD+bckJKKUWVlYNAw=='
2
<script nonce="YayonlD+bckJKKUWVlYNAw==">/* inline */</script>

Dependencies: cargo add getrandom base64.

Exercise 2: A correct `SameSite` session cookie

Difficulty: Intermediate

Objective: Build a session cookie with the right security attributes and understand why Lax (not Strict) is the usual choice for session cookies.

Instructions: Write build_session_cookie(value: &str) -> Cookie<'static> that sets HttpOnly, Secure, SameSite=Lax, and Path=/. Print the rendered cookie string. Then, in a comment, explain when you’d choose Strict instead.

Solution

1
use axum_extra::extract::cookie::{Cookie, SameSite};
2

3
fn build_session_cookie(value: &str) -> Cookie<'static> {
4
    Cookie::build(("session", value.to_owned()))
5
        .http_only(true) // JS (even injected XSS) cannot read it
6
        .secure(true) // never sent over plain HTTP
7
        .same_site(SameSite::Lax) // sent on top-level GET navigations, blocked on cross-site POST
8
        .path("/")
9
        .build()
10
}
11

12
fn main() {
13
    let c = build_session_cookie("abc123");
14
    println!("{}", c);
15
    // Choose SameSite::Strict for high-value cookies (e.g. an admin/banking session)
16
    // where you accept that following an external link into the app shows logged-out
17
    // until the next same-site request. Lax keeps "click a link while logged in" working,
18
    // which is why it's the default for ordinary session cookies.
19
}

Real output:

1
session=abc123; HttpOnly; SameSite=Lax; Secure; Path=/

Dependencies: cargo add axum-extra --features cookie.

Exercise 3: Timing-safe CSRF validator with length check

Difficulty: Advanced

Objective: Implement a CSRF validator that is correct against both forgery and timing attacks, and prove the constant-time path is taken.

Instructions: Write validate(cookie: &str, form: &str) -> bool that (a) rejects immediately if lengths differ — length is not secret — and (b) compares equal-length tokens in constant time with subtle. Add tests that a matching pair returns true, a wrong same-length token returns false, and a different-length token returns false. Explain why the early length check does not reintroduce a meaningful side channel.

Solution

1
use subtle::ConstantTimeEq;
2

3
/// Validate a CSRF token. Length is compared in variable time (it is not secret),
4
/// but token *bytes* of equal length are compared in constant time so an attacker
5
/// cannot recover the token byte-by-byte from response timing.
6
fn validate(cookie: &str, form: &str) -> bool {
7
    let (a, b) = (cookie.as_bytes(), form.as_bytes());
8
    if a.len() != b.len() {
9
        return false;
10
    }
11
    bool::from(a.ct_eq(b))
12
}
13

14
fn main() {
15
    let token = "0hGesYorQSmkT5ocqggUAmV9BzUAqPCJsmWsOdKzOuI";
16
    println!("match same       = {}", validate(token, token));
17
    println!("match wrong      = {}", validate(token, "0000000000000000000000000000000000000000000"));
18
    println!("match diff-len   = {}", validate(token, "short"));
19
}
20

21
#[cfg(test)]
22
mod tests {
23
    use super::validate;
24

25
    #[test]
26
    fn matching_pair_is_valid() {
27
        assert!(validate("deadbeef", "deadbeef"));
28
    }
29

30
    #[test]
31
    fn wrong_same_length_is_invalid() {
32
        assert!(!validate("deadbeef", "deadbeee"));
33
    }
34

35
    #[test]
36
    fn different_length_is_invalid() {
37
        assert!(!validate("deadbeef", "dead"));
38
    }
39
}

Real output:

1
match same       = true
2
match wrong      = false
3
match diff-len   = false

Why the length check is safe: the token length is fixed and public (every token you issue is the same size), so leaking “lengths differ” reveals nothing an attacker doesn’t already know. The contents — the only secret — are compared with ct_eq, which touches every byte regardless of where the first mismatch is, so timing reveals nothing about how many bytes matched. Dependencies: cargo add subtle.

XSS and CSRF Protection

Quick Overview

TypeScript/JavaScript Example

Rust Equivalent

Detailed Explanation

Output encoding (XSS defense)

CSRF protection

Content-Security-Policy (defense in depth)

Key Differences

Common Pitfalls

Pitfall 1: Bypassing auto-escaping with |safe

Pitfall 2: Building HTML with format! and serving it raw

Pitfall 3: Comparing tokens with ==

Pitfall 4: Returning mismatched response types from a handler

Pitfall 5: Forgetting secure / http_only on cookies

Best Practices

Real-World Example

Further Reading

Exercises

Exercise 1: Per-request CSP nonce

Exercise 2: A correct SameSite session cookie

Exercise 3: Timing-safe CSRF validator with length check

Pitfall 1: Bypassing auto-escaping with `|safe`

Pitfall 2: Building HTML with `format!` and serving it raw

Pitfall 3: Comparing tokens with `==`

Pitfall 5: Forgetting `secure` / `http_only` on cookies

Exercise 2: A correct `SameSite` session cookie