CSRF Explained: Tokens, SameSite Cookies, Origin Checks, and Fetch Metadata

CSRF Explained: Tokens, SameSite Cookies, Origin Checks, and Fetch Metadata

Cross-Site Request Forgery (CSRF) abuses a browser's automatically attached credentials—usually cookies—to make a logged-in user send an unwanted state-changing request.

CSRF matters mainly when authentication credentials are sent automatically by the browser.

Use the Right Primary Defense

For server-side session applications, OWASP recommends the synchronizer token pattern. Generate an unpredictable token tied to the session and require it on state-changing requests.

For stateless designs that need a double-submit approach, prefer a signed, session-bound double-submit token rather than a naive cookie comparison.

SameSite Helps, but Is Not Always Enough

Set session cookies with an appropriate SameSite policy, plus Secure and HttpOnly where applicable.

SameSite is valuable defense in depth, but it is scoped to site, not exact origin, and Lax still permits some top-level navigation behavior. Never make state-changing operations through GET.

Verify Request Origin

For sensitive state-changing requests, validate the Origin header and use Referer as a careful fallback where appropriate.

Modern browsers also send Fetch Metadata headers such as Sec-Fetch-Site. These can help reject obvious cross-site state-changing requests, with an Origin/Referer fallback for clients that do not provide the headers.

Rendering diagram…

JSON APIs Are Not Automatically Safe

If a browser API uses cookie authentication, it can still need CSRF defenses. Requiring non-simple content types/custom headers can help because browsers enforce CORS preflight rules, but CORS configuration must be strict.

Do not allow arbitrary origins with credentials.

Protect High-Risk Actions Further

For password changes, transfers, API-key creation, or destructive admin actions, consider re-authentication or explicit user confirmation in addition to CSRF defenses.

Final Takeaway

CSRF protection is strongest when browser cookie policy + request-origin checks + an application-level anti-CSRF mechanism work together. Never rely on a hidden UI, CORS alone, or SameSite alone without understanding your browser/session model.

References

• OWASP CSRF Prevention Cheat Sheet