← PHP theorytheory 0/50 · 0%

level 1

Curious · 0 XP

streak

perfect

badges

100 XP to Apprentice

Security · medium

31. CSRF Protection

Guarding state-changing requests.

1 min read2 questionsup to 50 XPtopic 31/50

Read in another language

AI translates the explanation and quiz text while preserving code and answer scoring.

Cross-Site Request Forgery tricks an authenticated user's browser into submitting an unwanted request to your app. Mitigation involves generating a unique, unpredictable CSRF token per session (or per form), embedding it in forms, and validating it server-side on every state-changing POST/PUT/DELETE request.

Additional layers like SameSite cookies (SameSite=Lax or Strict) further reduce cross-origin request risk by restricting when cookies are sent with cross-site requests.

How to study this topic

1. Read the explanation once end to end, skipping the code.
2. Re-read the code snippets and say out loud what each line does.
3. Answer the quiz without scrolling back — that is the real check.
4. Read every explanation, even for the answers you got right.

Scoring

· Up to 30 XP from quiz accuracy.
· +15 XP for a perfect first attempt.
· +5 XP while a 3-day streak is running.
· 75% or higher marks the topic complete.

Check your understanding

1. What is the standard mitigation for CSRF on form submissions?
Using GET instead of POSTA unique, validated CSRF token per session/formEncrypting the databaseRate limiting only
2. Which cookie attribute helps reduce CSRF risk?
HttpOnlySameSiteSecure onlyPath=/

Badges

First light

Pass your first topic

Sharp shooter

3 perfect first-try quizzes

On a roll

Study 3 days in a row

Week warrior

Study 7 days in a row

Grinder

Earn 500 XP

Deep diver

Earn 1500 XP