System Design · Middle · Question 17 of 75

How do you protect against CSRF with cookie-based authentication?

Explanation

The browser attaches cookies to requests from other sites. SameSite=Lax/Strict blocks most such scenarios, and a token or Origin check covers the rest. GET must not change data, otherwise the protection breaks.

Further reading

Problem with a question

System Design · Middle · question 17

Test yourself

Take the System Design · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.

Take this quiz