advancedCSRF: Cross-Site Request Forgery
How does a CSRF token actually stop a forged request?
The server issues a unique, hard-to-guess token per session/request and requires it to be present (matching) on every state-changing request. A malicious third-party page cannot read this token (due to Same-Origin Policy preventing it from reading responses/cookies belonging to a different origin), so any forged request it sends is missing the token or has an invalid one, and Spring Security's CsrfFilter rejects it with HTTP 403.
Ready to master this question?
Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.
Sign in to generate a response