CSRF Protection in Vue SPAs

Cross-Site Request Forgery tricks a logged-in user's browser into making an unwanted state-changing request to your site, using cookies the browser sends automatically. The attacker cannot read responses but can cause side effects like transfers or deletions.

If auth relies on a session cookie, the browser attaches it to every request to your domain - including ones triggered from a malicious site. The server cannot tell a forged request from a legitimate one without extra defense.