Anti-CSRF
Anti-CSRF is the set of measures that defend against cross-site request forgery, including CSRF tokens, SameSite cookies, and Origin/Referer checks.
Purpose
To defend against CSRF attacks comprehensively, ensuring state-changing requests originate from a legitimate source.
Mechanism
CSRF tokens (synchronizer pattern), SameSite=Strict/Lax cookies (the browser does not send them cross-site), and Origin/Referer header validation of the request origin. Double-submit cookies are a variant.
Use cases
- Comprehensive CSRF defense
- Web security baseline
- Session protection