Secure cookies still need explicit CSRF defense

A logged in user opens a malicious page, and the browser fires an authenticated transfer request.

I treat Secure, HttpOnly, and SameSite cookies as necessary hygiene, never as CSRF protection by itself.

OWASP places CSRF inside broken access control in the 2025 categories, so risky actions need explicit token checks.

The server must verify an unpredictable anti-CSRF token on every state changing request it accepts.

If HTTPS protects transit, not application logic secures the channel, then Strict CSP contains injected scripts by default shrinks what a forged request can achieve.

I set hardened cookie flags and verify tokens before honoring any risky action.