1. List practical rules for issuing and validating CSRF tokens in SPAs and classic server-rendered apps.
Difficulty: MediumType: SubjectiveTopic: AppSec
Generate strong, unpredictable tokens. Tie them to the user session. Send them in HTML or JSON, not in a cookie for synchronized token patterns. Validate on every state-changing request. Do not put tokens in URLs or logs. Rotate on login and at session renewal. For SPAs, fetch the token via a safe endpoint and attach it as a header. Keep SameSite on cookies for extra defense, but never rely on it alone
Example code
fetch('/csrf').then(t => localStorage.setItem('csrf', t))
// later: xhr.setRequestHeader('X-CSRF-Token', localStorage.getItem('csrf'))