حماية CSRF

Cross-Site Request Forgery rode high in the OWASP Top 10 for years and then quietly fell off as `SameSite=Lax` became the browser default. The bug isn't dead — it lives on in apps that use `SameSite=None` for cross-domain reasons (embedded widgets, third-party SSO contexts), in legacy session frameworks, in JSON APIs that mistakenly rely on Content-Type to gatekeep, and anywhere a developer thought 'we have auth, that's enough.' The blast radius is full impersonation: every action your app can perform through a logged-in user becomes performable from any other website that user happens to visit while logged in.

CSRF appears when state-changing actions rely only on ambient browser credentials. A malicious site can then attempt to make the victim's browser submit actions they did not intend.

Forced state changes performed as the victim — money transfer, password change, email-on-file change (precondition for account takeover), account deletion, content posting under their name. In OAuth / SSO contexts, login CSRF lets the attacker bind your account to an identity they control. For SaaS apps, CSRF can trigger billing changes, plan upgrades, or data exports without the user's knowledge.

Set `SameSite=Lax` (or `Strict` for high-value cookies) on every session cookie. Lax defeats the classic form-based CSRF for most cases without breaking normal navigation. For JSON APIs, require a custom header like `X-Requested-With: XMLHttpRequest` or a `X-CSRF-Token` — browsers won't send custom headers on cross-origin form submissions, so this is a strong gate. Use the synchronizer-token pattern for traditional server-rendered forms: include a per-session, per-form random token in the form HTML and verify it on submit. Modern frameworks (Django, Rails, Laravel, ASP.NET, Express with csurf) ship CSRF middleware; turn it on. Never mutate state on GET — turn account-delete-via-link patterns into POST with CSRF protection. Use `__Host-` cookie name prefix (`__Host-session`) to bind the cookie to your origin and forbid attribute downgrades. Audit your endpoints: if a request to a state-changing route succeeds without any of these defenses present, you have a finding.