CSRF Protection

Problem

You're logged into your bank. A malicious website causes your browser to submit: POST bank.com/transfer Your browser may automatically attach bank cookies.

Solution — CSRF Defenses

Require information the malicious site cannot simply cause the browser to supply correctly, such as an anti-CSRF token, while using appropriate cookie policies.

Core idea: CSRF protection prevents another site from abusing a user's authenticated browser session to perform unintended actions.