Home / Knowledge hub / CSRF token
Knowledge hub
CSRF token
A secret value in each form that proves the request came from your own page.
What it means
A CSRF token is a hard-to-guess value your server puts in a form or page and checks when the form comes back. If a request arrives without the right value, it is refused. The token proves the request started from your own page and not from another site.
It exists because browsers attach cookies automatically. A hostile page can make a signed-in visitor's browser send a request, and the cookie goes along. The attacker cannot read your page, so they cannot know the token and their copy of the request fails.
Why it matters
Without the check, an action you meant only the user to take can be triggered by anyone who tempts them to a page: change an email, move money, add an administrator. Everything arrives with a genuine session, so the log shows the user did it themselves.
It matters more as more of the app sits behind cookies. Defences like SameSite cookies help, but OWASP still recommends tokens for state-changing requests. A single endpoint without a check is enough, so coverage has to be complete, including the API routes added last.
How it shows up
Frameworks do most of the work: they generate a token per session or per request and check it on every POST, PUT, PATCH and DELETE. The common patterns are a synchroniser token stored on the server and a double-submit cookie. Token and CSRF protection must be on by default and not switched off for convenience.
The repeating mistakes: an endpoint exempted "just for the mobile app", a token that is not tied to the session, a check that passes when the field is missing, state changes on a GET request, and a token exposed to other sites through a loose CORS policy. Test by removing and swapping the token.
Questions people ask
CSRF token, answered
Does a CSRF token have to change on every request?
Not necessarily. OWASP notes that a token can last for the session or be renewed per request. Per-request tokens are stronger but break the back button and multiple tabs.
What matters is that it is unpredictable, tied to the session, and checked every time.
Is a SameSite cookie enough instead of a token?
It is a strong extra layer, not a full substitute. SameSite relates to sites, not origins, and its behaviour differs between browsers and for older ones.
OWASP advises using tokens and SameSite together as defence in depth.
Do APIs that use bearer tokens need CSRF tokens?
If authentication is carried by a header your own script adds, the browser does not send it automatically, so classic CSRF does not apply. If a cookie carries the session, it does.
Check how each endpoint authenticates rather than assuming.
Can XSS defeat a CSRF token?
Yes. Script running in your page can read the token and use it. A CSRF token protects against forged cross-site requests, not against code that runs inside your own site.
Fixing XSS is a separate job.
How is a CSRF token tested?
A tester submits a state-changing request with the token removed, then with another account's token, then with an old one, and sees whether the server still acts.
If it does, they show it with a page that triggers the request from another origin.
Sources
Where this comes from
Related
Terms that sit next to this one
CSRF
An attacker's page makes a logged-in user's browser act on your site.
SameSite cookie
A cookie setting that limits when a browser sends it on requests from other sites.
Nonce
A value issued for a single use, so it cannot be replayed later.
Session token
A random value the browser sends to show it belongs to a signed-in visit.
CORS misconfiguration
A CORS setup that lets sites you never meant to trust read your API responses.
Does your form check where it came from?
We send state-changing requests with the token missing, swapped or stale, and report only the ones the server accepted. Each finding carries the request, the response and, in white-box mode, the line. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.