CSRF Decision Path
Pick the request shape and protection layers, then watch where the browser or the server strips away ambient session authority.
Victim is logged in with SameSite=Lax on the session cookie.
No forged request yet. The attacker still has to choose a browser feature that can reach the bank.
The browser is only holding ambient authority at this step. No cross-site decision has been made yet.
Origin / Referer check: ON Synchronizer token required No CORS preflight in this shape
Dormant risk. A cookie in storage is harmless until another site finds a way to spend it.
<form action="https://bank.example/transfers" method="POST">...</form>
Request shape: cross-site form POST Session cookie: SameSite=Lax Cookie attached: no Preflight: not used Server checks Origin / Referer Token: attacker cannot provide it
Set-Cookie: session=...; Secure; HttpOnly; SameSite=Lax
CSRF starts with a perfectly legitimate login. The problem is what another site can make the browser do with that login later.
Current outcome: Safe state
Arrow keys to navigate · R to reset
Tap dots to jump to any step