thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Anti-CSRF Token

A secret, unpredictable value tied to the user's session that must accompany state-changing requests, proving they originated from the application.

Definition

In the synchronizer token pattern, the server stores the token and validates it on each POST, PUT or DELETE. Attackers on another site cannot read it due to the same-origin policy. Tokens must not be sent in URLs and must be validated server-side.

Example

A hidden form field csrf_token is checked against the session before a money transfer is processed.

Exam tip

Synchronizer tokens are the primary CSRF defense; SameSite cookies are defense in depth.

Related terms