CSRF Protection in React and API Setups

Cross-Site Request Forgery (CSRF) is an attack where a malicious website tricks the user's browser into sending an authenticated request to your API. Because the browser automatically attaches cookies to requests, the server cannot distinguish between a legitimate request from your app and a forged request from the attacker's site.

Cookies are the root cause of CSRF vulnerability. When a user is logged into your app, their session cookie is stored in the browser. When they visit the attacker's page, the attacker can trigger a form submission or fetch request to your API, and the browser automatically includes the session cookie — authenticating the malicious request.