Login form has CSRF protection

Login CSRF (CAPEC-62) lets an attacker log a victim into an attacker-controlled account using a forged cross-site request. This enables account takeover indirectly: the victim, now logged into the attacker's account, may enter sensitive data that the attacker can later retrieve. CWE-352 (CSRF) on a login endpoint is classified under OWASP A01 (Broken Access Control); PCI-DSS v4.0 Req-6.2.4 explicitly lists cross-site request forgery among the software attacks that engineering practices must prevent. SameSite=Lax provides meaningful browser-enforced protection for most cases, but explicit CSRF token validation is required for custom endpoints that process sensitive actions on navigation.

If using NextAuth, CSRF protection is built into the credential callback — do not bypass the standard signin form flow. For custom endpoints, add explicit CSRF token validation:

import { csrf } from '@edge-csrf/nextjs'
const csrfProtect = csrf({ cookie: { secure: true } })

export async function POST(request: Request) {
  const csrfError = await csrfProtect(request)
  if (csrfError) return Response.json({ error: 'Invalid CSRF token' }, { status: 403 })
  // login logic
}

Verify session cookies have SameSite=Lax set (see the session-tokens-secure check) as a defense-in-depth layer. Do not rely on SameSite alone when you can add a CSRF token.