Cross-Site Request Forgery (CSRF) Defense: Token Architecture & SameSite Cookies

1. Executive Summary & CSRF Attack Mechanics

Cross-Site Request Forgery (CSRF) is an attack that forces an authenticated end-user to execute unwanted, state-changing actions on a trusted web application. When a victim visits a malicious site, the adversary's page triggers an HTTP request (via hidden forms, fetch calls, or images) to the vulnerable application. Because the victim's browser automatically attaches existing session cookies, the server executes the action under the victim's identity.

Classification

OWASP Top 10 • CWE-352 (Cross-Site Request Forgery) • CERT-In VAPT Mandatory Check

2. Multi-Layered CSRF Defense Architecture

Modern web security mandates two complementary layers of defense: Cryptographic Anti-CSRF Tokens and SameSite Cookie Enforcements.

A. Synchronizer Token Pattern (STP) - PHP Implementation

Generate a unique, cryptographically random, unpredictable token stored in the server session and injected into forms as a hidden field:

<?php // 1. Generate CSRF Token on Session Initialization if (empty($_SESSION['csrf_token'])) { $_SESSION['csrf_token'] = bin2hex(random_bytes(32)); } // 2. Inject into HTML Form function csrf_field(): string { $token = htmlspecialchars($_SESSION['csrf_token'] ?? '', ENT_QUOTES, 'UTF-8'); return '<input type="hidden" name="csrf_token" value="' . $token . '">'; } // 3. Server-Side Validation on State-Changing POST Requests if ($_SERVER['REQUEST_METHOD'] === 'POST') { $submittedToken = $_POST['csrf_token'] ?? ''; $sessionToken = $_SESSION['csrf_token'] ?? ''; // Constant-time string comparison to prevent timing attacks if (!hash_equals($sessionToken, $submittedToken)) { http_response_code(403); die("CSRF Token Verification Failed: Request Discarded."); } } ?>

B. Modern Cookie Hardening: SameSite Flags

Configure session cookies to block transmission on cross-origin requests:

// PHP 8+ Hardened Session Cookie Configuration session_start([ 'cookie_lifetime' => 0, // Invalidate on browser close 'cookie_path' => '/', 'cookie_secure' => true, // Transmit exclusively over HTTPS 'cookie_httponly' => true, // Inaccessible via client-side JavaScript (anti-XSS) 'cookie_samesite' => 'Lax', // Blocks cookie on cross-site POST requests 'use_strict_mode' => true // Prevents session fixation ]);

SameSite Setting	Top-Level Navigation (e.g. clicking link)	Cross-Site POST (Form / Fetch)	Security Profile
Strict	Blocked	Blocked	Maximum protection; user appears logged out if clicking link from email.
Lax (Recommended)	Allowed	Blocked	Standard balance; safe against all cross-site POST attacks.
None	Allowed	Allowed	Permits cross-site requests; requires `Secure` flag. High CSRF risk.

3. Securing Single-Page Apps (SPA) & REST APIs

For asynchronous fetch() or Axios requests, pass the CSRF token via standard HTTP headers (e.g., X-CSRF-Token or X-XSRF-Token):

// Frontend JavaScript Fetch with CSRF Header const csrfToken = document.querySelector('meta[name="csrf-token"]').getAttribute('content'); fetch('/api/user/update', { method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrfToken }, body: JSON.stringify({ email: '[email protected]' }) });

4. CSRF Defense Audit Checklist

Audit Check	Compliance Standard	Pass Criteria
State-Changing Methods	GET, HEAD, and OPTIONS requests must be strictly idempotent (never modify state).	Zero state mutations triggered via GET query parameters.
Token Randomness	Generated via cryptographically secure pseudo-random number generator (CSPRNG).	Minimum 128-bit entropy (e.g. 32-byte hex).
Constant-Time Verification	Token comparison executes via `hash_equals()`.	Zero susceptibility to string comparison timing attacks.
Cookie Hardening	Session cookies marked with `SameSite=Lax` (or `Strict`), `Secure`, and `HttpOnly`.	Verified via browser DevTools Application tab.

WebOTG Standards Directorate

Application Security Architect

WebOTG provides benchmark reference documentation, automated matrix evaluators, and security test harnesses for government digital platforms, WQMS architectures, and STQC compliance frameworks.