csrf/mitigation_strategy

CSRF prevention framework priorities

Apply CSRF defenses in this order: (1) First check if your framework has built-in CSRF protection and use it; (2) If no built-in protection, add CSRF tokens to all state-changing requests and validate them on the backend; (3) For modern browsers only, consider Fetch Metadata headers with fallback options; (4) Use synchronizer token pattern for stateful software or double-submit cookies for stateless software; (5) Consider custom request headers for API-driven sites that cannot use form tags; (6) Implement at least one mitigation from Defense in Depth Mitigations section.