Stopping CSRF

Prove the request is genuine

CSRF works because a cookie travels automatically; the defences add something that does not:

Tip: Require an unpredictable per-session CSRF token on every state-changing request and reject requests without it; set session cookies SameSite=Lax or Strict so they aren't sent on cross-site requests; and verify the Origin/Referer for sensitive actions. Use POST for changes — but POST alone is not a defence.