What is CSRF and how do you protect against it in APIs?

Question

Ravi Vishwakarma · Answer

CSRF (Cross-Site Request Forgery) is a type of web security vulnerability where a malicious website tricks a user's browser into making unauthorized requests to a different site where the user is already authenticated. Example of a CSRF Attack: Let’s say: You're logged into https://mybank.com.You visit a malicious site: http://evil.com.That site runs JavaScript like: The browser automatically includes cookies for mybank.com with that request — even though the request came from a malicious site. ➡ Result: Money transferred without user’s intention. CSRF Is a Threat Only When: Authentication is cookie-based (since cookies are automatically sent).The user is logged in.The attacker can trick the user into loading or submitting a request. How to Protect APIs from CSRF Method Works With Description Anti-Forgery Tokens (CSRF Tokens) Cookie-based auth (e.g., MVC, Razor, SPAs with cookies) Server generates a random token, which the client must send back. Server verifies it. Use Bearer Tokens (e.g., JWT) APIs with headers (not cookies) No cookies → no CSRF risk. Tokens must be manually sent with requests, so attacker can't forge them. SameSite Cookies Cookie-based sessions Set cookies with SameSite=Strict or Lax so they're not sent on cross-origin requests. Disable unsafe HTTP methods Public APIs Accept only GET (safe) unless authenticated. Validate Origin or Referer headers Browser requests Server checks if request is from a trusted domain. Most Secure Setup for APIs If your API is: Used by a browser with cookies → use Anti-Forgery Tokens.Used by SPAs, mobile apps, Postman, etc. → use JWTs or API Keys in Authorization headers instead of cookies. Why JWT is safer for APIs? Stored in memory (not cookies).Must be added to the Authorization header by JavaScript: Attackers cannot forge or steal it with a CSRF attack. In Summary Technique Prevents CSRF? Applies To Anti-forgery token Yes Cookie-auth apps (e.g., MVC forms, Razor pages) JWT / Bearer token in header Yes APIs (SPAs, mobile apps) SameSite cookies Yes Prevents auto-sending cookies cross-site Checking Origin / Referer Yes Basic validation layer (not foolproof) If your Web API is authenticated using cookies, and it supports browser-based users, you should implement CSRF tokens. If you're building a RESTful API for SPAs or mobile apps, use bearer tokens or API keys — then CSRF is not a concern. Would you like a code example of CSRF protection in: ASP.NET MVC with Razor views?Or a token-based authentication setup for Web API?

Method	Works With	Description
Anti-Forgery Tokens (CSRF Tokens)	Cookie-based auth (e.g., MVC, Razor, SPAs with cookies)	Server generates a random token, which the client must send back. Server verifies it.
Use Bearer Tokens (e.g., JWT)	APIs with headers (not cookies)	No cookies → no CSRF risk. Tokens must be manually sent with requests, so attacker can't forge them.
SameSite Cookies	Cookie-based sessions	Set cookies with `SameSite=Strict` or `Lax` so they're not sent on cross-origin requests.
Disable unsafe HTTP methods	Public APIs	Accept only `GET` (safe) unless authenticated.
Validate Origin or Referer headers	Browser requests	Server checks if request is from a trusted domain.

Technique	Prevents CSRF?	Applies To
Anti-forgery token	Yes	Cookie-auth apps (e.g., MVC forms, Razor pages)
JWT / Bearer token in header	Yes	APIs (SPAs, mobile apps)
SameSite cookies	Yes	Prevents auto-sending cookies cross-site
Checking `Origin` / `Referer`	Yes	Basic validation layer (not foolproof)

interview

What is CSRF and how do you protect against it in APIs?

Can you answer this question?

1 Answers

Example of a CSRF Attack:

CSRF Is a Threat Only When:

How to Protect APIs from CSRF

Most Secure Setup for APIs

In Summary