csrf.page

A reference for cross-site request forgery that is accurate for 2026 — not for 2015. Delivery techniques, token and header defences, bypasses, and prevention across seven frameworks.

attacker.example/index.html
<form id="poc" action="https://bank.example/transfer" method="POST">
  <input type="hidden" name="to" value="attacker" />
  <input type="hidden" name="amount" value="5000" />
</form>
<script>document.getElementById('poc').submit()</script>

Whether that still works depends entirely on one line of the target's Set-Cookie header — and on which browser the victim is using.

What still works in 2026Generate a PoC

Start here: CSRF in 2026

What still works and what died with Lax-by-default, browser by browser. Most CSRF advice online predates all of it.

Cheatsheet

Which request shapes carry a cookie under each SameSite value, plus what every major framework does by default.

PoC Generator

Nine delivery shapes, four cookie policies. Copy-pasteable HTML plus a per-browser verdict on whether the cookie is actually sent.

Lab

A simulated bank and a real attacker page in a sandboxed iframe. Toggle defences and watch which one stops the request.

Four things that changed

Cross-site POST is dead in Chrome

Chromium has defaulted cookies to SameSite=Lax since Chrome 80. The textbook auto-submitting POST form no longer works there.

It still works in Firefox and Safari

Neither shipped a Lax default. The same PoC that fails in Chrome succeeds in both — which is why a finding has to name the browser.

GET was never covered

Lax sends the cookie on a top-level GET navigation by design. An endpoint that changes state on GET gained nothing from any of this.

Subdomains are same-site

evil.example.com and app.example.com are the same site. SameSite offers zero protection against a subdomain takeover.

32 guides

Every behavioural claim on this site is derived from one file and checked at build time.