CSRF · Cross-Site Request Forgery

Understand the idea

A malicious page can attempt to trigger a state-changing action on another site where the visitor is signed in. A CSRF token helps distinguish an intended form submission. The security design depends on how credentials are transported.

A concrete example

Thymeleaf form
→ hidden CSRF field
→ server verifies token

In the application

The MVC lab keeps CSRF protection. The personal API disables it for its bearer-header design with no authentication cookie.

If you move JWT authentication into cookies, revisit CSRF protection rather than copying the current API setting unchanged.

See it in a working stage

• Stage 14: bring the concepts together in a Todo list application

Related concepts

• CORS · Cross-Origin Resource Sharing
• Authentication
• Thymeleaf
• Bearer token