Nedum84/csrf-with-rsa

Implementing Advanced CSRF Protection with RSA in React and Vite. This is an interesting idea to encrypt with a public key and use the private key on the BE to decrypt and use timestamp to prevent replay attacks. I'm not sure how easily it could be reverse engineered, but its at least some decently sufficient security through obscurity.

Summary

Nedum84/csrf-with-rsa is a TypeScript demo that shows how to add CSRF protection to a web API using 2048-bit RSA encryption. It is built as a React + Vite client that pairs with a server-side RSA step, and is intended as a working reference rather than a drop-in library. The repository links to a live GitHub Pages demo and a longer write-up on Dev.to that explains the design.

What it is useful for

The project is useful for engineers who want to see what RSA-based CSRF protection looks like in code, as opposed to reading about it abstractly. The README frames it as protection against unauthorized clients, meaning the server issues an RSA-encrypted token that the browser must present on state-changing requests, and the same token is bound to a key the client cannot forge without the private key. That is a stronger model than cookie-only CSRF tokens, and is most relevant when:

• Your API is called from a single-page app and you want a token that is not trivially copyable by a malicious origin.
• You are evaluating whether to replace or complement an existing CSRF strategy (for example, double-submit cookies) with public-key cryptography.
• You want a runnable example to discuss with a team before committing to a security design.

A live demo is hosted at the GitHub Pages URL in the README, so the flow can be observed in the browser without cloning anything.

How engineers can use it

Because the README is short and only links out to a Dev.to article for implementation details, the safest path is:

1. Clone the repository and open it in a code editor to read the source alongside the article on Dev.to that the README points to.
2. Run the Vite dev server locally to see the client behavior, and stand up the matching server component described in the article, since the README does not document a one-command setup.
3. Compare the RSA flow in this repo against your current CSRF middleware to decide whether a public-key model is worth the extra complexity for your use case.

Documented limitations to keep in mind: the README does not specify a license, dependency list, or test suite, and it does not claim production readiness. Treat it as an educational reference and verify the cryptographic choices against current OWASP guidance before adopting the pattern in a real application.