CSRF tokens on state-changing requests

Cross-site request forgery (CWE-352) allows a malicious page to trigger authenticated state-changing requests in a victim's browser using their existing session cookie. Without CSRF protection, any site can silently transfer funds, change email addresses, or delete accounts on behalf of a logged-in user. OWASP A01 (Broken Access Control) ranks CSRF among the most exploited web vulnerabilities. NIST 800-53 SC-23 requires session authenticity protection. The attack requires no special privileges — a single malicious link is sufficient. Cookies with SameSite=Lax or Strict are the minimal defense; APIs accepting cookie-authenticated requests need explicit origin validation on top.

For Next.js apps, validate the Origin header on every state-changing route and ensure cookies are SameSite=Lax at minimum:

export function validateOrigin(req: Request): boolean {
  const origin = req.headers.get('origin')
  const host = req.headers.get('host')
  if (!origin || !host) return false
  return new URL(origin).host === host
}

For richer CSRF protection, use the csrf-csrf double-submit cookie pattern in src/middleware.ts. Do not rely on SameSite=None — it provides zero CSRF protection.