What is CSRF and how do you defend against it?

Summary

Cross-Site Request Forgery tricks a logged-in user's browser into sending an unwanted state-changing request to your site, because browsers automatically attach cookies. Defend with SameSite cookies, anti-CSRF tokens, Origin/Referer checks, and never changing state on GET.

Longer Answer

Token-based APIs using the Authorization header aren't vulnerable because browsers don't attach those headers automatically. Frameworks include CSRF middleware (Django, Laravel, Spring Security, Flask-WTF).

Key Points

• Exploits automatic cookies
• SameSite=Lax/Strict
• Synchronizer or double-submit tokens
• Origin checks
• No state change on GET