--- title: A CSRF token is not an authorization decision | daily.dev description: Discussion about "A CSRF token is not an authorization decision" on daily.dev - join the developer community canonical: https://daily.dev/posts/a-csrf-token-is-not-an-authorization-decision-gqe7hajt6 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: A CSRF token is not an authorization decision | daily.dev og:description: Discussion about "A CSRF token is not an authorization decision" on daily.dev - join the developer community og:url: https://daily.dev/posts/a-csrf-token-is-not-an-authorization-decision-gqe7hajt6 og:image: https://api.daily.dev/og/posts/GQe7Hajt6.png og:image:alt: A CSRF token is not an authorization decision og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A CSRF token is not an authorization decision **[Auth By Example](https://daily.dev/sources/7eadcwhmohx0bchehapmt)** · [@authbyexample](https://daily.dev/authbyexample) · 0 upvotes · 0 comments ## Content A CSRF token proves the browser request likely came from your site's own pages, not a cross-site form forge. That is request authenticity for cookie sessions. It does not decide which tenants, objects, or actions the signed-in user may touch. Teams sometimes treat "CSRF check passed" as "this mutation is allowed." That only blocks a class of cross-site attacks. It says nothing about object ownership, role, relationship, or policy. What to do instead: 1. Authenticate the session, then still authorize the concrete action and resource on the server for every sensitive write — and for sensitive reads that leak data. 2. Never skip per-object checks because the CSRF cookie matched. A legitimate same-site request from user A can still ask for user B's invoice id. 3. Keep CSRF protection for cookie-based browsers; add Authorization (Bearer/API keys) paths that do not rely on CSRF the same way, and still authorize those callers. 4. Prefer deny-by-default when resource context is missing. A CSRF-valid POST with a guessed id must fail the authz check, not succeed because the token was fresh. Quick check: while logged in as tenant A with a valid CSRF token, POST an update for tenant B's object id. If it succeeds, you had anti-forgery — not authorization. CSRF answers "did this request come from my pages?" Authorization answers "may this user do this to this object?" --- [View this post on daily.dev](https://daily.dev/posts/a-csrf-token-is-not-an-authorization-decision-gqe7hajt6) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/a-csrf-token-is-not-an-authorization-decision-gqe7hajt6","headline":"A CSRF token is not an authorization decision","text":"Discussion about \"A CSRF token is not an authorization decision\" on daily.dev - join the developer community","url":"https://daily.dev/posts/a-csrf-token-is-not-an-authorization-decision-gqe7hajt6","datePublished":"2026-10-04T05:37:41.469Z","dateModified":"2026-10-04T05:37:41.469Z","author":{"@type":"Person","name":"Auth By Example","url":"https://daily.dev/authbyexample","image":"https://media.daily.dev/image/upload/s--Fgz7IgGQ--/f_auto/v1789653205/avatars/avatar_7EADCwHmOHX0bChEhAPmt?_a=BAMAMicg0","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":60}},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/7eadcwhmohx0bchehapmt","name":"Auth By Example"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Auth By Example","item":"https://daily.dev/sources/7eadcwhmohx0bchehapmt"},{"@type":"ListItem","position":3,"name":"A CSRF token is not an authorization decision"}]} ```