CSRF Prevention リファレンス
リファレンス 用 Cross-Site リクエスト Forgery prevention: tokens, SameSite, および origin checking.
CSRF Mechanism
CSRF exploits the browser's automatic attachment of cookies to cross-site requests. The victim is tricked into making a state-changing request (form submission, fetch) to a site where they are authenticated. The attack succeeds because cookies prove identity, not intent. GET requests should never change state. CSRF is possible with any authentication mechanism that auto-attaches (cookies, HTTP auth). The attack is blind: the response is not readable cross-origin.
- cookie auth
- Auto-attached
- state change
- POST/PUT/DELETE
- blind
- Response not readable
exploited by CSRFnot GETcross-originDefense Techniques
Synchronizer tokens embed a per-session random token in forms, validated server-side. Double-submit cookies store the token in both cookie and form, compared server-side. SameSite cookies (Lax/Strict) prevent cross-site sending, the modern default. Origin/Referer header validation rejects cross-site requests. Custom request headers (X-Requested-With) require CORS preflight, blocking simple forms. Combine multiple defenses for robustness; SameSite alone has edge cases.
- synchronizer
- Per-session token
- SameSite
- Cookie attribute
- Origin check
- Header validation
form fieldmodern defaultreject cross-site