CSRF: Control specification

Defines CSRF defenses for browser-authenticated state changes using same-site request design, server-validated tokens or headers, origin checks, safe methods, and tests for login and cross-origin edge cases.

Published Sep 12, 2026