Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

7
  • Thanks for the detailed info. During the post request , the site has to send the csrf token to the server, so when will the client send this csrf token to the server? Is it while making the preflight options request? Please elablorate on this part.. Commented Nov 30, 2018 at 10:25
  • 4
    @Dan How come b.com can access the cookies of another site a.com? Commented Feb 9, 2019 at 21:13
  • 1
    great explanation! Commented Jan 17, 2022 at 15:01
  • But where does one get the token? Which request usually returns it? Commented Aug 16, 2022 at 16:21
  • Nice explanation. I have one question:- So CSRF token is valid per request or per user and changes after each request ? Commented Sep 17, 2022 at 6:50