3
votes
2answers
755 views

Why are CSRF tokens necessary?

It seems that the entire problem could be solved very elegantly by simply adding a new flag to the HTTP cookie specification. Similarly to how cookies flagged Secure will only be submitted by the ...