What is CSRF and how do you protect against it in APIs?

Question

ICSM Computer · Answer

CSRF (Cross-Site Request Forgery) is a type of web security vulnerability where a malicious website tricks a user's browser into making 
unauthorized requests to a different site where the user is 
already authenticated.
Example of a CSRF Attack:
Let’s say:
You're logged into https://mybank.com.You visit a malicious site: http://evil.com.That site runs JavaScript like:
andlt;img src="https://mybank.com/api/transfer?amount=1000andto=attacker" /andgt;
The browser automatically includes cookies for mybank.com with that request — even though the request came from a malicious site.
➡ Result: Money transferred without user’s intention.
CSRF Is a Threat Only When:
Authentication is cookie-based (since cookies are automatically sent).The user is logged in.The attacker can trick the user into loading or submitting a request.
How to Protect APIs from CSRF
Method
Works With
Description
Anti-Forgery Tokens (CSRF Tokens)
Cookie-based auth (e.g., MVC, Razor, SPAs with cookies)
Server generates a random token, which the client must send back. Server verifies it.
Use Bearer Tokens (e.g., JWT)
APIs with headers (not cookies)
No cookies → no CSRF risk. Tokens must be manually sent with requests, so attacker can't forge them.
SameSite Cookies
Cookie-based sessions
Set cookies with SameSite=Strict or Lax so they're 
not sent on cross-origin requests.
Disable unsafe HTTP methods
Public APIs
Accept only GET (safe) unless authenticated.
Validate Origin or Referer headers
Browser requests
Server checks if request is from a trusted domain.
Most Secure Setup for APIs
If your API is:
Used by a browser with cookies → use Anti-Forgery Tokens.Used by SPAs, mobile apps, Postman, etc. → use JWTs or API Keys in
Authorization headers instead of cookies.
Why JWT is safer for APIs?
Stored in memory (not cookies).Must be added to the Authorization header by JavaScript:
Authorization: Bearer andlt;your-tokenandgt;
Attackers cannot forge or steal it with a CSRF attack.
In Summary
Technique
Prevents CSRF?
Applies To
Anti-forgery token
Yes
Cookie-auth apps (e.g., MVC forms, Razor pages)
JWT / Bearer token in header
Yes
APIs (SPAs, mobile apps)
SameSite cookies
Yes
Prevents auto-sending cookies cross-site
Checking Origin / Referer
Yes
Basic validation layer (not foolproof)
If your Web API is authenticated using cookies, and it supports
browser-based users, you should implement CSRF tokens.
If you're building a RESTful API for SPAs or mobile apps, 
use bearer tokens or API keys — then CSRF is not a concern.
Would you like a code example of CSRF protection in:
ASP.NET MVC with Razor views?Or a token-based authentication setup for Web API?

interview

What is CSRF and how do you protect against it in APIs?

ICSM Computer

Can you answer this question?

1 Answers

Example of a CSRF Attack:

CSRF Is a Threat Only When:

How to Protect APIs from CSRF

Most Secure Setup for APIs

In Summary

Liked By

Method	Works With	Description
Anti-Forgery Tokens (CSRF Tokens)	Cookie-based auth (e.g., MVC, Razor, SPAs with cookies)	Server generates a random token, which the client must send back. Server verifies it.
Use Bearer Tokens (e.g., JWT)	APIs with headers (not cookies)	No cookies → no CSRF risk. Tokens must be manually sent with requests, so attacker can't forge them.
SameSite Cookies	Cookie-based sessions	Set cookies with `SameSite=Strict` or `Lax` so they're not sent on cross-origin requests.
Disable unsafe HTTP methods	Public APIs	Accept only `GET` (safe) unless authenticated.
Validate Origin or Referer headers	Browser requests	Server checks if request is from a trusted domain.

Technique	Prevents CSRF?	Applies To
Anti-forgery token	Yes	Cookie-auth apps (e.g., MVC forms, Razor pages)
JWT / Bearer token in header	Yes	APIs (SPAs, mobile apps)
SameSite cookies	Yes	Prevents auto-sending cookies cross-site
Checking `Origin` / `Referer`	Yes	Basic validation layer (not foolproof)