Why should you care?

Banking and admin actions need CSRF protection on state-changing requests.

See it live — copy this example

Paste into an HTML file or the browser console (F12). Use Run below when the live editor is available.

// Server sends CSRF token; client sends header on POST
// fetch("/api/transfer", {
//   method: "POST",
//   headers: { "X-CSRF-Token": tokenFromMetaTag },
//   body: JSON.stringify({ amount: 100 })
// });

Run Example »

Edit the code below and click Run to see the result in Toolliyo’s live editor.

What happened?

• Attacker site cannot read your token due to same-origin policy.
• Server validates token.

Practice next

1. Read CSRF token header pattern in fetch POST.
2. Set SameSite=Lax on session cookies.
3. Require custom header for JSON APIs.
4. Read token from meta tag and attach to fetch headers in example sketch.
5. Compare SameSite Strict vs Lax behavior docs.

Remember

CSRF token on mutations SameSite cookies Server validates

ScriptVerse wire transfer

Bank POST /transfer requires X-CSRF-Token matching server session so evil.com cannot forge requests.

Outcome: CSRF tokens block cross-site form posts against logged-in banking users.