CS Fundamentals Trainer · JavaScript · Security

Which of these help protect a cookie-authenticated app against CSRF?

  1. Using POST instead of GET for the state-changing endpoint
  2. Setting the session cookie to `SameSite=Lax` or `SameSite=Strict`
  3. Sending `Access-Control-Allow-Origin` only for your own front-end origin
  4. Requiring a per-session CSRF token that the server checks on each state-changing request
  5. Rejecting state-changing requests whose `Origin` header is not your own

Difficulty: medium

Answer this question

Related questions