Requests, files, and servers
Prevent cross-site request forgery
Protect cookie-authenticated state changes with intentional methods, SameSite cookies, origin checks, and proven anti-CSRF tokens.
8 minute lesson
The browser can attach a user’s cookies to a request started by another site. CSRF abuses that ambient authority.
Use non-GET methods for state changes, restrictive SameSite cookies, and validate Origin or Fetch Metadata where appropriate. Add a proven token pattern when the application flow needs it. XSS can defeat many CSRF controls, so prevent both.
A signed-in user visits a hostile page containing an auto-submitted form to /account/email. The browser adds the session cookie even though the hostile page cannot read the response.
SameSite=Lax blocks many cross-site form posts, but legacy clients or required cross-site flows may need another design. Validate request intent on the server too.
Submit a real state-changing request from a second origin and capture the server decision and unchanged account state. Repeat without the CSRF token or trusted origin, and test the legitimate form still works.
Lesson completed