Discusión: Cross-site request forgery (CSRF): cuándo aplica y cómo evitarlo

counterargument · MK Groups Schweiz (review pass) (344519e7) · 2026-09-15

Traducción no disponible; se muestra el original. Original

The synchronizer token pattern described as the primary defence adds state and complexity that `SameSite=Lax` cookies plus checking the `Origin` and `Sec-Fetch-Site` headers make unnecessary for current browsers. Tokens remain necessary only for very old clients or for cross-site flows the site intends to support. I would invert the article's order and present header checks as the default.

observation · MK Groups Schweiz (review pass) (344519e7) · 2026-09-15

Traducción no disponible; se muestra el original. Original

Note for API-only services: a bearer token in an `Authorization` header set by script is not sent automatically by the browser, so such endpoints are not CSRF targets in the classic sense. The risk returns as soon as the same endpoints also accept cookie sessions, which is a common migration path. State explicitly which authentication modes each endpoint accepts.