As modern web applications continue to grow in complexity, protecting users and sensitive data has become a critical responsibility for developers.

Among the most dangerous and common web security threats are CSRF attacks. Although these attacks may appear simple, they can allow attackers to perform sensitive actions on behalf of authenticated users without their knowledge.

Many modern systems rely heavily on sessions and authentication cookies, making CSRF protection especially important for:

* admin panels
* management systems
* e-commerce platforms
* banking applications
* membership websites
* MVC applications
* APIs

In this article, we will explore what CSRF is, how these attacks work, and the best modern practices for preventing them in PHP and MVC applications.

---

# What Is CSRF?

CSRF stands for:

Cross-Site Request Forgery

It refers to attacks where malicious websites trick authenticated users into sending unintended requests to trusted applications.

---

# How CSRF Attacks Work

When users log into a website, the browser stores authentication cookies or sessions.

If the user later visits a malicious website, that site may attempt to send requests to the original application using the victim’s active session.

Since browsers automatically send cookies, the application may incorrectly trust the request.

---

# Simple Example of a CSRF Attack

Imagine a money transfer form:

```html
<form action="https://example.com/transfer" method="POST">
<input type="hidden" name="amount" value="1000">
<input type="hidden" name="to" value="attacker">
</form>
```

If the victim is already logged in, the request may execute automatically.

---

# Why CSRF Is Dangerous

CSRF attacks may allow attackers to:

* change passwords
* delete data
* modify accounts
* perform financial transactions
* create users
* change email addresses

all while impersonating the victim.

---

# Difference Between CSRF and XSS

Many developers confuse the two attacks.

---

# XSS

Injects malicious JavaScript into web pages.

---

# CSRF

Exploits the trust between authenticated users and websites.

---

# When Applications Become Vulnerable to CSRF

Applications are vulnerable when they:

* rely on session cookies
* fail to validate request origins
* do not use CSRF tokens
* allow sensitive POST requests without protection

---

# What Is a CSRF Token?

A CSRF token is a random value generated for sessions or forms.

The server verifies this token before processing sensitive actions.

---

# Why Tokens Are Effective

Attackers cannot easily guess or access the secret token stored within the user’s session.

---

# Creating a CSRF Token in PHP

Simple example:

```php
if (empty($_SESSION['csrf'])) {
   $_SESSION['csrf'] = bin2hex(random_bytes(32));
}
```

---

# Adding the Token to Forms

```php
<input type="hidden"
      name="csrf_token"
      value="<?= $_SESSION['csrf'] ?>">
```

---

# Verifying the Token

```php
if (
   !isset($_POST['csrf_token']) ||
   $_POST['csrf_token'] !== $_SESSION['csrf']
) {
   die('Invalid CSRF token');
}
```

---

# Best Practices for CSRF Tokens

# 1. Use Strong Random Tokens

Prefer:

```php
random_bytes()
```

instead of older methods.

---

# 2. Generate Tokens Per Session or Request

Some systems use:

* one token per session
* a new token per form

Per-request tokens are more secure.

---

# 3. Expire Tokens Regularly

Tokens should not remain valid indefinitely.

---

# 4. Avoid Exposing Tokens in JavaScript

This helps reduce XSS-related risks.

---

# 5. Protect All Sensitive Actions

Including:

* deletion
* updates
* payments
* account changes

---

# Why POST Is Safer Than GET

Sensitive operations should never use GET requests.

---

# Unsafe Example

```html
<a href="/delete/5">Delete</a>
```

---

# Better Approach

Use POST forms:

```html
<form method="POST">
<button>Delete</button>
</form>
```

---

# Protecting Delete Actions in Admin Panels

Many developers forget to secure delete functionality.

---

# Secure Example

```php
<form method="POST"
     action="/admin/posts/delete/5">

<input type="hidden"
      name="csrf_token"
      value="<?= $_SESSION['csrf'] ?>">

<button type="submit">
Delete
</button>

</form>
```

---

# SameSite Cookies and CSRF Protection

Modern browsers support SameSite cookies.

---

# What They Do

They reduce cookie sharing during cross-site requests.

---

# Recommended Configuration

```php
session_set_cookie_params([
   'samesite' => 'Strict'
]);
```

---

# SameSite Modes

## Strict

Most secure option.

---

## Lax

Balances security and usability.

---

## None

Allows cross-site cookies and requires HTTPS.

---

# Validating Referer and Origin Headers

Some applications verify:

* Origin headers
* Referer headers

to ensure requests come from trusted sources.

---

# Is This Alone Enough?

No.

Some browsers and networks may not always send these headers.

---

# CSRF Protection in AJAX Requests

AJAX requests should also include CSRF tokens.

---

# Example Using Fetch API

```javascript
fetch('/save', {
   method: 'POST',
   headers: {
       'X-CSRF-TOKEN': csrfToken
   }
});
```

---

# Verifying Inside PHP

```php
$token = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
```

---

# CSRF Protection in MVC Frameworks

Modern MVC frameworks often include built-in protection.

---

# Examples

## Laravel

Provides automatic CSRF protection.

Laravel

---

# Blade Example

```php
@csrf
```

---

## Symfony

Includes powerful form security systems.

Symfony

---

# CSRF and APIs

APIs that use tokens instead of cookies are generally less vulnerable to CSRF.

---

# Why?

Browsers do not automatically send authorization tokens like cookies.

---

# Do APIs Need CSRF Protection?

If APIs rely on:

* session cookies
* authentication cookies

then the answer is yes.

---

# Common CSRF Protection Mistakes

# 1. Using static tokens

---

# 2. Failing to validate tokens

---

# 3. Protecting only some forms

---

# 4. Using GET for sensitive actions

---

# 5. Exposing tokens insecurely in JavaScript

---

# The Importance of Security Testing

CSRF defenses should be tested regularly.

---

# Testing Methods

## Submit requests without tokens

---

## Use security testing tools

---

## Test across different browsers and sessions

---

# Useful Security Testing Tools

## OWASP ZAP

An open-source web security testing tool.

OWASP ZAP

---

## Burp Suite

One of the most popular penetration testing platforms.

Burp Suite

---

# The Relationship Between CSRF and XSS

If an application contains XSS vulnerabilities, attackers may steal CSRF tokens.

For this reason:
XSS and CSRF protections must work together.

---

# Building a Complete Protection Strategy

## Use CSRF tokens

---

## Secure sessions properly

---

## Enable SameSite cookies

---

## Validate request origins

---

## Prevent XSS

---

## Use HTTPS

---

# Why HTTPS Matters

HTTPS prevents interception of:

* sessions
* cookies
* tokens

during transmission.

---

# The Future of CSRF Protection

Modern browsers continue introducing stronger security mechanisms, but developers still carry the primary responsibility for protecting applications.

Modern systems require:

* layered security
* regular audits
* continuous updates

---

# Conclusion

CSRF attacks remain among the most dangerous web security threats because they exploit trusted authenticated sessions.

Effective protection depends on:

* CSRF tokens
* secure session handling
* using POST for sensitive operations
* SameSite cookies
* request validation

Strong security is never based on a single technique, but rather on multiple defensive layers working together to protect users and applications.