Fundamentals · Hard · Free
What is CSRF and how do cookies + tokens mitigate it?
FresherFundamentalsWeb & Full-Stack
CSRF defense
Attacker tricks logged-in user's browser to POST to your site. Mitigate: SameSite cookies, CSRF tokens on state-changing forms, verify Origin header.
- GET should not change state
- Double-submit cookie or synchronizer token
JWT in Authorization header less CSRF-prone than cookie session—but XSS then steals token.