diff --git a/appengine/building-an-app/update/package.json b/appengine/building-an-app/update/package.json
index c320fc64744..755e7ca7ded 100644
--- a/appengine/building-an-app/update/package.json
+++ b/appengine/building-an-app/update/package.json
@@ -19,6 +19,8 @@
   "author": "Google Inc.",
   "license": "Apache-2.0",
   "dependencies": {
+    "cookie-parser": "^1.4.6",
+    "csurf": "^1.11.0",
     "express": "^4.18.2"
   },
   "devDependencies": {
diff --git a/appengine/building-an-app/update/server.js b/appengine/building-an-app/update/server.js
old mode 100755
new mode 100644
index f453e82cd9c..90c8333915d
--- a/appengine/building-an-app/update/server.js
+++ b/appengine/building-an-app/update/server.js
@@ -16,13 +16,18 @@
 
 // [START gae_update_web_server_app]
 const express = require('express');
+const cookieParser = require('cookie-parser');
+const csrf = require('csurf');
+const fs = require('fs').promises;
 const path = require('path');
 
 const app = express();
 
 // [START gae_enable_parser]
 // This middleware is available in Express v4.16.0 onwards
+app.use(cookieParser());
 app.use(express.urlencoded({extended: true}));
+app.use(csrf({cookie: true}));
 // [END gae_enable_parser]
 
 app.get('/', (req, res) => {
@@ -30,8 +35,18 @@ app.get('/', (req, res) => {
 });
 
 // [START gae_add_display_form]
-app.get('/submit', (req, res) => {
-  res.sendFile(path.join(__dirname, '/views/form.html'));
+app.get('/submit', async (req, res, next) => {
+  try {
+    const token = req.csrfToken();
+    const template = await fs.readFile(path.join(__dirname, '/views/form.html'), 'utf-8');
+    const html = template.replace(
+      '<form method="POST" action="/submit">',
+      `<form method="POST" action="/submit"><input type="hidden" name="_csrf" value="${token}">`
+    );
+    res.send(html);
+  } catch (err) {
+    next(err);
+  }
 });
 // [END gae_add_display_form]