Laravel

<?php
// Laravel 11/12 style. In Laravel 10 and earlier this lives in the $except
// property of App\Http\Middleware\VerifyCsrfToken.

return Application::configure(basePath: dirname(__DIR__))
    ->withMiddleware(function (Middleware $middleware) {
        $middleware->validateCsrfTokens(except: [
            // Added for one Stripe webhook. The wildcard exempts every route
            // under /webhooks -- including ones added later by someone who
            // has no idea this list exists.
            'webhooks/*',

            // Added during an integration and never removed. This is the
            // entire API surface.
            'api/*',

            // The worst case, seen more often than it should be: this
            // disables CSRF protection for the whole application.
            '*',
        ]);
    })->create();

// A genuine third-party webhook DOES need an exemption -- the caller has no
// token. But it must then authenticate by SIGNATURE, not by session cookie.
// If a route in this list is reachable with a session cookie, it is a
// finding.

<?php
return [
    // Scoped to the parent domain, so every subdomain receives the session
    // cookie AND can overwrite it. Usually set so that api.example.com can
    // see the session -- a real requirement with a real cost.
    'domain' => '.example.com',

    // Not enforced over HTTPS. A network position on plaintext for any
    // subdomain can read or shadow the cookie.
    'secure' => false,

    // null means the browser decides: Lax in Chromium, nothing in Firefox
    // and Safari. Behaviour differs by engine and the team cannot reason
    // about it.
    'same_site' => null,

    // 'none' is worse -- it explicitly opts out of SameSite entirely and
    // restores the full pre-2020 attack surface.
    // 'same_site' => 'none',
];

{{-- @csrf renders the hidden _token input. A hand-written <form> without
     it returns 419 Page Expired, which is Laravel's CSRF failure status. --}}
<form method="POST" action="{{ route('account.email') }}">
  @csrf
  <input type="email" name="email" required>
  <button type="submit">Update</button>
</form>

{{-- HTML forms cannot emit PUT, PATCH, or DELETE, so Laravel provides
     @method, which renders a hidden _method field. Note this is exactly the
     override mechanism an attacker uses -- it is fine here because the CSRF
     token is still required, but it means a route reachable by POST is also
     reachable as a PUT. --}}
<form method="POST" action="{{ route('account.destroy') }}">
  @csrf
  @method('DELETE')
  <button type="submit">Delete account</button>
</form>

{{-- For fetch/XHR: --}}
<meta name="csrf-token" content="{{ csrf_token() }}">