CSRF Protection
Generate and validate CSRF tokens in forms to prevent forged requests.
What is CSRF?
Cross-Site Request Forgery (CSRF) tricks authenticated users into submitting unwanted actions. A malicious page sends a forged request to your site using the victim's active session.
How CSRF Works
Scenario: Alice is logged in to bank.com. She visits malicious.com which has a hidden form that auto-submits a transfer request to bank.com using her session cookie.