When an authenticated user visits an external site, attackers can trigger unauthorized state changes on their behalf. Here is how to configure HMAC-backed anti-CSRF tokens and SameSite cookie policies in Node.js to block forgery attempts.