Skip to content

access

The cookie is not consent

Cross-site request forgery, and what a token bound to the session adds.

A browser attaches your cookies to a request because of where the request is going, not because of where it came from. That is the whole mechanism, it is why sessions work at all, and it is why a form on somebody else's page can send an authenticated request as you.

So the cookie answers one question — who is this? — and a state-changing request needs the answer to a second one: did they mean to send this? A token the page had to have been served in order to know is what answers it.

  • POST /profile

    A request with a session cookie and nothing else. One of these builds asks for more.

This build

id.example.com

Nothing sent yet. Every request goes to the application in this tab and nowhere else.