medium10 pts · first answer countssecurityauthentication

CSRF with cookie sessions

Your app authenticates with a session cookie. Which combination best protects state-changing requests from CSRF attacks?

A.Use only GET requests so nothing changesB.Hide the submit button with CSS on other sitesC.Set the cookie with SameSite=Lax or Strict and also check a CSRF token or the Origin header on POST, PUT and DELETED.Store the session id in a URL query parameter instead

← The N+1 query problem Server Components and the database →