Cross-Site Request Forgery Prevention Cheat Sheet
Source: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html
Fetched: 2026-07-23 (curl direct fetch, HTML stripped to plain text; excerpt limited to the sentences cited by raw/official-docs/csrf-prevention-owasp-official.md)

Introduction

A Cross-Site Request Forgery (CSRF) attack occurs when a malicious web site, email, blog, instant message, or program tricks an authenticated user's web browser into performing an unwanted action on a trusted site.

Since browser requests automatically include all cookies including session cookies, this attack works unless proper authorization is used.

Token-Based Mitigation

The synchronizer token pattern is one of the most popular and recommended methods to mitigate CSRF.

Synchronizer Token Pattern

if (!constantTimeEquals(hmacFromRequest, expectedHmac)) {
    // HMAC validation failed, reject the request
    response.sendError(403, "Invalid CSRF token")
    logError("Invalid CSRF token", hmacFromRequest, expectedHmac)
    return
}

Limitations of SameSite

SameSite is useful as a defense-in-depth control but it does not replace a proper CSRF defense in most deployments.
