"The CSRF token is invalid. Please try to resubmit the form." in Symfony, "419 Page Expired" in Laravel, "CSRF verification failed. Request aborted." in Django: every web developer has run into one of these errors. The CSRF token is one of those protections everyone uses, because the framework turns it on by default, and few people can explain. In my audits I regularly find routes excluded from the check "because it was getting in the way", or, the other way round, Bearer token APIs that demand a CSRF token for nothing.

This article covers the whole question: what the token really protects, when it is still needed in the age of SameSite cookies, and how Symfony, Laravel, Django and Rails take care of it. Along the way, it explains a detail from a recent Practice exercise : why a simple search using the new HTTP QUERY method can be asked for a token.

The attack: making the victim's browser act

CSRF stands for Cross-Site Request Forgery . The attacker steals nothing.…