Skip to content
hashkey.bond

Archivesecurity

CSRF in 2026: Mostly Solved, Still Misconfigured

SameSite cookies plus origin checks close the classic attack. Custom headers and token endpoints still need care.

Published
Reading time
1 min read

Cross-site request forgery tricks a logged-in browser into sending an authenticated request to your site. The browser attaches cookies automatically; the attacker never sees the response, but the side effect happens.

What actually works

  • SameSite=Lax/Strict cookies: cross-site POSTs do not carry the cookie by default. This alone blocks most classic CSRF.
  • Origin/Referer checks on state-changing requests: cheap and effective, with a documented policy for missing headers.
  • CSRF tokens for form posts, bound to the session and validated server-side. Still needed where cookies are SameSite=None.
  • Custom header requirement (X-Requested-With or a bearer token): cross-origin forms cannot set arbitrary headers without CORS preflight.

Where it still bites

  • APIs that accept text/plain or form-encoded bodies and rely on cookies.
  • SameSite=None for cross-site embeds.
  • GET endpoints that mutate state — they bypass most protections.

Takeaway: make state changes non-GET, use SameSite, and check Origin. Tokens remain necessary for legacy cross-site cookie flows.