CSRF Protection
What is CSRF, and how do SameSite cookies and anti-forgery tokens prevent it?
Answers use simple, clear English.
Quick interview answer
CSRF tricks a browser into sending authenticated cookies on a forged cross-site request. Anti-forgery tokens (synchronizer token) must be presented from the legitimate origin. SameSite=Lax/Strict cookies reduce cross-site sends.
Detailed answer
CSRF tricks a browser into sending authenticated cookies on a forged cross-site request. Anti-forgery tokens (synchronizer token) must be presented from the legitimate origin. SameSite=Lax/Strict cookies reduce cross-site sends. For APIs using Authorization headers (not cookies), classic CSRF is less relevant. CORS alone does not stop cookie-based CSRF for simple form posts.
Full explanation
CORS alone does not stop cookie-based CSRF for simple form posts.
Real example & use case
Evil page posts to bank.example.com/transfer while the user still has a session cookie.
Pros & cons
Pros of SameSite+tokens: strong browser defense. Cons: embedded cross-site flows and native WebViews need careful exceptions.