--- title: CSRF from Scratch: Browser Mechanics, Attacks, and... description: A comprehensive bottom-up guide to Cross-Site Request Forgery (CSRF), starting from HTTP statelessness and browser cookie mechanics, then building up through... canonical: https://daily.dev/posts/csrf-from-scratch-browser-mechanics-attacks-and-spring-security-implementation-full-handbook--4km8mrcii twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CSRF from Scratch: Browser Mechanics, Attacks, and Spring Security Implementation [Full Handbook] | daily.dev og:description: A comprehensive bottom-up guide to Cross-Site Request Forgery (CSRF), starting from HTTP statelessness and browser cookie mechanics, then building up through... og:url: https://daily.dev/posts/csrf-from-scratch-browser-mechanics-attacks-and-spring-security-implementation-full-handbook--4km8mrcii og:image: https://api.daily.dev/og/posts/4KM8mrCIi.png og:image:alt: CSRF from Scratch: Browser Mechanics, Attacks, and Spring Security Implementation [Full Handbook] og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CSRF from Scratch: Browser Mechanics, Attacks, and Spring Security Implementation [Full Handbook] **[freeCodeCamp](https://daily.dev/sources/freecodecamp)** · [@ashutoshkrris](https://daily.dev/ashutoshkrris) · 41 min read · 17 upvotes · 4 comments ## Summary A comprehensive bottom-up guide to Cross-Site Request Forgery (CSRF), starting from HTTP statelessness and browser cookie mechanics, then building up through the full attack anatomy, why Same Origin Policy and CORS don't prevent CSRF, and how defenses like CSRF tokens (Synchronizer Token Pattern), Double Submit Cookie, and SameSite cookie attributes work. The guide then covers JWT storage trade-offs (localStorage vs HttpOnly cookies), Login CSRF via OAuth state parameter, and concludes with a detailed walkthrough of Spring Security's CSRF internals (CsrfFilter, CsrfTokenRepository, XorCsrfTokenRequestAttributeHandler) plus a from-scratch custom CSRF filter implementation in Java 21. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why doesn't CORS protect my Spring Boot API from CSRF attacks? CORS is designed to relax the Same Origin Policy for reading cross-origin responses, not to block requests from being sent. Simple requests using standard content types like application/x-www-form-urlencoded bypass CORS preflight checks entirely, so an attacker's HTML form can still trigger a state-changing POST request before any CORS header is ever evaluated. _Anyone hardening an API against CSRF can review architecture breakdowns like this on daily.dev before assuming CORS has it covered._ ### Is storing a JWT in an HttpOnly cookie safe from CSRF attacks? No, storing a JWT in an HttpOnly cookie is vulnerable to CSRF unless explicitly defended, because the browser automatically attaches any cookie, including a JWT cookie, to cross-site requests targeting the issuing domain. HttpOnly only stops JavaScript from reading the cookie to prevent XSS theft; it does nothing to stop the browser's ambient cookie attachment that CSRF exploits. _Developers weighing JWT storage strategies can find comparisons like this on daily.dev before picking a token storage approach._ ### Does SameSite=Lax make CSRF tokens unnecessary in Spring Security apps? No, SameSite=Lax should be treated as defense-in-depth rather than a full replacement for CSRF tokens. Lax still allows cookies on top-level cross-site GET navigations, legacy browsers and embedded web views may not enforce SameSite defaults, and some browsers apply a temporary Lax-by-default grace window for top-level POSTs on newly set cookies, leaving gaps CSRF tokens still need to close. _Teams deciding how much CSRF protection is enough can weigh trade-offs like these on daily.dev before shipping a security config._ ## Community discussion Top comments from developers on daily.dev. **@allinonetools** · 1 upvotes > Really solid deep dive. The browser mechanics + Spring Security internals made CSRF much easier to understand, especially the Login CSRF and SameSite parts. **@devdavidt** · 0 upvotes > This is useful in an era where attackers become so much stronger with AI. **@pedropietro** · 0 upvotes >  **@rizzdev** · 0 upvotes > Token rotation under multi-tab is the cost that sticks after you ship this. SameSite=Lax still fails on a few top-level flows too ## Similar posts on daily.dev - [CSRF Attack Explained: Mechanics, Real Exploits, and How to Test for It](https://daily.dev/posts/csrf-attack-explained-mechanics-real-exploits-and-how-to-test-for-it-lkzyruhyf) · Latest Hacking News · 0 upvotes · 0 comments - [CSRF Protection without Tokens or Hidden Form Fields](https://daily.dev/posts/csrf-protection-without-tokens-or-hidden-form-fields-a651bvhew) · Hacker News · 0 upvotes · 0 comments - [What's the best way to do authentication in modern applications](https://daily.dev/posts/what-s-the-best-way-to-do-authentication-in-modern-applications-7iho9es5q) · Neciu Dan · 25 upvotes · 1 comments - [Auth Mastery Part 2: Sessions, Cookies, and Staying Authenticated](https://daily.dev/posts/auth-mastery-part-2-sessions-cookies-and-staying-authenticated-zk5kkxcot) · InfoSec Write-ups · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#java](https://daily.dev/tags/java), [#web-security](https://daily.dev/tags/web-security), [#spring-security](https://daily.dev/tags/spring-security) [View this post on daily.dev](https://daily.dev/posts/csrf-from-scratch-browser-mechanics-attacks-and-spring-security-implementation-full-handbook--4km8mrcii) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CSRF from Scratch: Browser Mechanics, Attacks, and Spring Security Implementation [Full Handbook]","url":"https://daily.dev/posts/csrf-from-scratch-browser-mechanics-attacks-and-spring-security-implementation-full-handbook--4km8mrcii","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/csrf-from-scratch-browser-mechanics-attacks-and-spring-security-implementation-full-handbook--4km8mrcii"},"datePublished":"2026-08-07T01:02:48.620Z","dateModified":"2026-09-14T07:00:29.310Z","description":"A comprehensive bottom-up guide to Cross-Site Request Forgery (CSRF), starting from HTTP statelessness and browser cookie mechanics, then building up through...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/46b41c9a05c3ee6418929374039ea1e7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/46b41c9a05c3ee6418929374039ea1e7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"freeCodeCamp","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Person","name":"Ashutosh Krishna","url":"https://daily.dev/ashutoshkrris","image":"https://avatars.githubusercontent.com/u/47353498?v=4","description":"Software Engineer | Backend Systems | Java, Spring Boot & Cloud","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":630}},"commentCount":4,"discussionUrl":"https://daily.dev/posts/csrf-from-scratch-browser-mechanics-attacks-and-spring-security-implementation-full-handbook--4km8mrcii","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":17},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":4}],"keywords":"security,java,web-security,spring-security","timeRequired":"PT41M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"freeCodeCamp","item":"https://daily.dev/sources/freecodecamp"},{"@type":"ListItem","position":3,"name":"CSRF from Scratch: Browser Mechanics, Attacks, and Spring Security Implementation [Full Handbook]"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/csrf-from-scratch-browser-mechanics-attacks-and-spring-security-implementation-full-handbook--4km8mrcii","comment":[{"@type":"Comment","text":"Really solid deep dive. The browser mechanics + Spring Security internals made CSRF much easier to understand, especially the Login CSRF and SameSite parts.","datePublished":"2026-08-10T03:19:24.211Z","url":"https://daily.dev/posts/4KM8mrCIi#c-sx6LbjAIQ","author":{"@type":"Person","name":"AllInOneTools","url":"https://daily.dev/allinonetools","image":"https://media.daily.dev/image/upload/s--4ZT8QlF0--/f_auto/v1769790028/avatars/avatar_igzBsWloJeaegzm9bQltZ?_a=BAMAMiiu0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"This is useful in an era where attackers become so much stronger with AI.","datePublished":"2026-08-07T04:58:55.438Z","url":"https://daily.dev/posts/4KM8mrCIi#c-CPsvVRHpq","author":{"@type":"Person","name":"DavidDev","url":"https://daily.dev/devdavidt","image":"https://media.daily.dev/image/upload/s--jxmKsIov--/f_auto/v1788950401/avatars/avatar_HK0Qdu9ttIpcoDHx7zrHk?_a=BAMAMicg0"}},{"@type":"Comment","text":"","datePublished":"2026-08-07T12:13:58.906Z","url":"https://daily.dev/posts/4KM8mrCIi#c-zGwU2Assx","author":{"@type":"Person","name":"Pedro Pietroluongo","url":"https://daily.dev/pedropietro","image":"https://avatars.githubusercontent.com/u/1533471?v=4"}},{"@type":"Comment","text":"Token rotation under multi-tab is the cost that sticks after you ship this. SameSite=Lax still fails on a few top-level flows too","datePublished":"2026-08-11T17:22:10.007Z","url":"https://daily.dev/posts/4KM8mrCIi#c-jtXHN2FCS","author":{"@type":"Person","name":"Andrew","url":"https://daily.dev/rizzdev","image":"https://media.daily.dev/image/upload/s--35vRfXAA--/f_auto/v1785413727/avatars/avatar_fQ7ttCKtPuu6tDvcgQXv5?_a=BAMAMicg0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/csrf-from-scratch-browser-mechanics-attacks-and-spring-security-implementation-full-handbook--4km8mrcii#faq","mainEntity":[{"@type":"Question","name":"Why doesn't CORS protect my Spring Boot API from CSRF attacks?","acceptedAnswer":{"@type":"Answer","text":"CORS is designed to relax the Same Origin Policy for reading cross-origin responses, not to block requests from being sent. Simple requests using standard content types like application/x-www-form-urlencoded bypass CORS preflight checks entirely, so an attacker's HTML form can still trigger a state-changing POST request before any CORS header is ever evaluated. Anyone hardening an API against CSRF can review architecture breakdowns like this on daily.dev before assuming CORS has it covered."}},{"@type":"Question","name":"Is storing a JWT in an HttpOnly cookie safe from CSRF attacks?","acceptedAnswer":{"@type":"Answer","text":"No, storing a JWT in an HttpOnly cookie is vulnerable to CSRF unless explicitly defended, because the browser automatically attaches any cookie, including a JWT cookie, to cross-site requests targeting the issuing domain. HttpOnly only stops JavaScript from reading the cookie to prevent XSS theft; it does nothing to stop the browser's ambient cookie attachment that CSRF exploits. Developers weighing JWT storage strategies can find comparisons like this on daily.dev before picking a token storage approach."}},{"@type":"Question","name":"Does SameSite=Lax make CSRF tokens unnecessary in Spring Security apps?","acceptedAnswer":{"@type":"Answer","text":"No, SameSite=Lax should be treated as defense-in-depth rather than a full replacement for CSRF tokens. Lax still allows cookies on top-level cross-site GET navigations, legacy browsers and embedded web views may not enforce SameSite defaults, and some browsers apply a temporary Lax-by-default grace window for top-level POSTs on newly set cookies, leaving gaps CSRF tokens still need to close. Teams deciding how much CSRF protection is enough can weigh trade-offs like these on daily.dev before shipping a security config."}}]} ```