csrf-protection

CSRF protection for state-changing endpoints is implemented using synchronizer tokens for server-rendered forms and double-submit cookies for SPAs. These mechanisms ensure attackers cannot perform actions on behalf of authenticated users when cookies are automatically sent.

Synchronizer token patterns store a server-side session token matched against submitted forms, while double submit cookie patterns send a random value in both a cookie and a request header. CSRF defense applies synchronizer tokens to server-rendered apps and double-submit cookies to SPAs.

SameSite cookie configurations limit cross-origin risks by restricting when cookies are automatically sent with requests. In SPAs, SameSite and Secure attributes provide CSRF defense alongside double-submit cookies, but origin and referer validation adds necessary defense-in-depth for sensitive endpoints.

Origin and referer validation provides defense-in-depth for sensitive endpoints like password changes and payment actions, verifying request sources even if token validation succeeds. CSRF tokens alone mitigate cross-site forgery, but layered validation ensures robust protection against sophisticated bypass attempts.

CSRF tokens apply to login, logout, and sensitive account actions across both server-rendered apps and SPAs. Synchronizer tokens protect server-rendered forms while double-submit cookies secure SPA state-changing operations including POST, PUT, PATCH, and DELETE requests.

Cookie-based CSRF protection using SameSite attributes alone lacks comprehensive coverage without token rotation and constant-time comparisons. Limitations include browser compatibility variations and potential bypass scenarios, requiring layered token validation and origin checks for robust defense.