CSRF and cookie security
Comes up in: Web fundamentals, Recruiter screen
This concept is being written. It gets the full five steps — explanation, predict, interview angle, practice with tests, and review cards. Here is exactly what it will cover, so you can study it elsewhere in the meantime.
What it covers
- how CSRF works
- SameSite as defence-in-depth
- CSRF tokens (synchroniser, double-submit)
- checking
Origin/Sec-Fetch-Site - why JSON APIs are not automatically safe
Words you will know
What you will practise
- exploit and fix a CSRF demo
Interview questions this answers
- Explain CSRF and how to prevent it. Does SameSite solve it fully?