topic
Verified 2026-09-18Cross-Site Request Forgery (CSRF)
An attack where a victim browser is induced to send an authenticated state-changing request.
Use SameSite cookies, CSRF tokens, and Origin or Referer validation as appropriate for cookie-authenticated applications.
httpsecuritycookiescsrf
Reference (http)
Origin: https://app.example.com X-CSRF-Token: <token>
Use SameSite cookies, CSRF tokens, and Origin or Referer validation as appropriate for cookie-authenticated applications.
Common mistakes
- Assuming CORS or HttpOnly cookies alone prevents CSRF.