CSRF and JWT Cookies
Cross-Site Request Forgery tricks a victim browser into sending authenticated requests to your site using cookies the browser attaches automatically. If you store JWTs in cookies, CSRF becomes relevant in ways that differ from Authorization bearer headers that JavaScript must set explicitly on each call. Defenses include SameSite cookie attributes, anti-CSRF tokens for state-changing requests, double-submit cookie patterns, and careful separation of cookie scopes. LocalStorage JWTs avoid classic cookie CSRF but increase the impact of XSS because scripts can read the token. Choose storage deliberately and pair it with the matching mitigations for XSS and CSRF rather than optimizing for only one threat model.
Why It Matters
Moving JWTs into httpOnly cookies improves XSS posture but reintroduces CSRF if you skip SameSite attributes and anti-CSRF controls on mutating routes. Security designs must evaluate XSS and CSRF together. Document the chosen browser auth model so frontend and API teams do not mix incompatible assumptions about credentials and CORS. If JWTs ride in cookies, set SameSite deliberately, prefer CSRF tokens or double-submit patterns on state-changing routes, and avoid wildcard CORS with credentialed cookies. Re-review the model whenever frontend origin lists change.
Related Terms
Related Comparisons
Related Tools
Related Articles
Frequently Asked Questions
Do bearer Authorization headers need CSRF tokens?
Classic CSRF targets cookie credentials on cross-site form posts. Pure Authorization bearer headers from JS are a different model, but cookie-based JWT sessions still need CSRF defenses.
Is SameSite=Lax enough by itself?
Often helpful but not always sufficient for all cross-site flows. Combine SameSite with CSRF tokens on state-changing routes and strict origin allowlists for credentialed APIs.
Can CSRF steal the JWT string?
Classic CSRF usually causes the browser to send the cookie automatically; attackers may trigger state-changing actions without reading the token value, which is why anti-CSRF controls still matter.