topic
Verified 2026-09-18CSRF Token Patterns
CSRF tokens bind a state-changing request to an application interaction that an attacker’s site cannot reproduce.
Use a synchronizer token for server-side sessions or a carefully implemented signed double-submit cookie for stateless flows. Validate the token server-side, require it on state-changing methods, and combine it with SameSite and Origin checks.
httpsecuritycsrfcookiesapi
Reference (http)
POST /profile HTTP/1.1 Origin: https://app.example.com X-CSRF-Token: random-server-checked-value
Use a synchronizer token for server-side sessions or a carefully implemented signed double-submit cookie for stateless flows. Validate the token server-side, require it on state-changing methods, and combine it with SameSite and Origin checks.
Common mistakes
- Accepting a token copied from a cookie without binding it to the session, placing tokens in URLs, or protecting only POST while leaving PUT, PATCH, DELETE, or state-changing GET endpoints exposed.