How CSRF Attacks Work and How to Protect Your Frontend Application

Cross-Site Request Forgery (CSRF) is a security attack where an authenticated user is tricked into unknowingly triggering an unintended action on a web application. Attackers exploit the browser's automatic cookie-sending behavior to make malicious requests appear legitimate. One of the most effective defenses is the use of CSRF tokens — randomly generated, cryptographically secure values that the server associates with a user's session. When the frontend makes state-changing requests such as POST, PUT, PATCH, or DELETE, it must include this token in a custom HTTP header, which the backend then validates before processing the request. Importantly, CSRF tokens serve a distinct purpose from authentication tokens, as they verify the legitimacy of the request source rather than the identity of the user.