Topic starter
Cookies are central to CSRF because they are how websites usually maintain a logged-in session.
When you log into a website:
- The server creates a session.
- Your browser stores a session cookie like:
Set-Cookie: sessionid=abc123
After that, your browser automatically sends this cookie with every request to that website.
Example:
Cookie: sessionid=abc123
The browser does not check whether the request came from:
- the real website
- or a malicious website
Posted : 07/05/2026 11:07 pm
