CSRFToken

CSRF token, or cross-site request forgery token, is a secret value used by web applications to distinguish legitimate requests from forged requests that arrive from another site. The token is generated by the server and tied to the user's session or the specific form being submitted.

During a state-changing request (such as POST, PUT, DELETE), the token must be included by the client, typically as a hidden form field or a request header. The server checks the token against the expected value stored on the server; if they match, the request is allowed; if not, it is rejected.

There are two common approaches: synchronizer tokens, where the server stores a token and validates it on submission; and double-submit cookies, where the token is sent both in a cookie and in a request value and the server verifies that both match.

Implementation notes: tokens should be unpredictable, rotated after use, and scoped to a session or form. They are commonly embedded in HTML forms or supplied in AJAX requests (for example as X-CSRF-Token headers). For modern browsers, many frameworks provide built-in CSRF protection; devs should avoid exposing tokens in URL query parameters and should require state-changing requests to include the token.

Limitations: CSRF protection does not protect against cross-site scripting (XSS); if an attacker can read the token through XSS or other local access, they can impersonate the user. Defense-in-depth includes proper input sanitization, HttpOnly cookies for session data, and Content Security Policy.