Implement Cross-Site Request Forgery (CSRF) protection using tokens, SameSite cookies, and origin validation. Use when building forms and state-changing operations.

CSRF Protection Table of Contents [Overview]( overview) [When to Use]( when to use) [Quick Start]( quick start) [Reference Guides]( reference guides) [Best Practices]( best practices) Overview Implement comprehensive Cross Site Request Forgery protection using synchronizer tokens, double submit cookies, SameSite cookie attributes, and custom headers. When to Use Form submissions State changing operations Authentication systems Payment processing Account management Any POST/PUT/DELETE requests Quick Start Minimal working example: Reference Guides Detailed implementations in the references/ directory: Guide Contents [Node.js/Express CSRF Protection](references/nodejsexpress csrf protection.md) Node.js/Express CSRF Protection [Double Submit Cookie Pattern](references/double submit cookie pattern.md) Double Submit Cookie Pattern [Python Flask CSRF Protection](references/python flask csrf protection.md) Python Flask CSRF Protection [Frontend CSRF Implementation](references/frontend csrf implementation.md) Frontend CSRF Implementation [Origin and Referer Validation](references/origin and referer validation.md) Origin and Referer Validation Best Practices ✅ DO Use CSRF tokens for all state changing operations Set SameSite=Strict on cookies Validate Origin/Referer headers Use secure, random tokens Implement token expiration Use HTTPS only Include tokens in AJAX requests Test CSRF protection ❌ DON'T Skip CSRF for authenticated requests Use GET for state changes Trust Origin header alone Reuse tokens Store tokens in localStorage Allow credentials in CORS without validation

csrf-protection