CSRF Token
A CSRF token is an unpredictable random value generated by the server and bound to the session, embedded in forms/request headers to verify the request origin is legitimate.
Purpose
To defend against cross-site request forgery, ensuring requests come from a legitimate page rather than a malicious site.
Mechanism
The server generates a random token for the session and embeds it in a hidden form field or a custom header. On submission the server compares the token and rejects on mismatch. SameSite cookies provide additional protection.
Use cases
- Form CSRF protection
- API CSRF protection
- Session security