How to configure Axios for least‑privilege security in browser and Node.js apps

When using Axios to make HTTP requests, applying the principle of least privilege helps reduce the attack surface. Which configuration options should be set to limit data size, prevent cross‑site request forgery, and avoid sending unnecessary credentials?

• Set maxContentLength and maxBodyLength to cap response and request body sizes.
• Enable XSRF protection by configuring xsrfCookieName, xsrfHeaderName, and withXSRFToken.
• Keep withCredentials false unless cross‑site authentication is required.

Explain how these settings interact with Axios defaults, instance creation, and interceptors, and provide a minimal example that demonstrates a secure Axios instance.