> For the complete documentation index, see [llms.txt](https://docs.hackerspot.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hackerspot.net/web-security/web-vulnerabilities/cross-site-request-forgery/csrf-example-usages.md).

# CSRF Example Usages

#### Good Example

Using the `SameSite` attribute correctly to enhance security by restricting the cookie to same-site requests:

```http
httpCopy codeSet-Cookie: sessionId=abc123; Secure; HttpOnly; SameSite=Strict
```

**Explanation:**

* **`sessionId=abc123`**: The cookie name and value.
* **`Secure`**: Ensures the cookie is only sent over HTTPS.
* **`HttpOnly`**: Prevents the cookie from being accessed via JavaScript, mitigating XSS attacks.
* **`SameSite=Strict`**: The cookie will only be sent for requests originating from the same site, providing strong protection against CSRF attacks.

#### Bad Example

Misusing the `SameSite` attribute or omitting it entirely, potentially leading to security vulnerabilities:

```http
httpCopy codeSet-Cookie: sessionId=abc123; Secure; HttpOnly
```

**Explanation:**

* **`sessionId=abc123`**: The cookie name and value.
* **`Secure`**: Ensures the cookie is only sent over HTTPS.
* **`HttpOnly`**: Prevents the cookie from being accessed via JavaScript, mitigating XSS attacks.
* **Missing `SameSite` attribute**: Without the `SameSite` attribute, the cookie is sent with both same-site and cross-site requests by default, which could expose the application to CSRF attacks.

#### Another Bad Example

Using an inappropriate value for the `SameSite` attribute:

```http
httpCopy codeSet-Cookie: sessionId=abc123; Secure; HttpOnly; SameSite=None
```

**Explanation:**

* **`sessionId=abc123`**: The cookie name and value.
* **`Secure`**: Ensures the cookie is only sent over HTTPS.
* **`HttpOnly`**: Prevents the cookie from being accessed via JavaScript, mitigating XSS attacks.
* **`SameSite=None`**: While this allows the cookie to be sent with cross-site requests, it can only be secure if combined with `Secure`. If `Secure` is not present, it leaves the application vulnerable to CSRF attacks.