A Quarter Century of CSRF. Now the Browser Finally Handles It

Cross-Site Request Forgery has been with us since at least the turn of the millennium. The principle is primitive: a foreign website sends a request to your server from the browser of an unsuspecting victim. The browser happily attaches cookies to it, so the request looks like a legitimate action by a logged-in user: a password change, a form submission, an account deletion. And for a whole…