security auth_error ai_generated true

403 Forbidden: CSRF token validation failed

ID: security/csrf-token-mismatch

Also available as: JSON · Markdown
85%Fix Rate
88%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

CSRF token missing or doesnt match session.

generic

Workarounds

  1. 92% success Ensure CSRF token is included in all state-changing forms/requests
  2. 90% success Use SameSite=Lax or Strict cookie attribute

Dead Ends

Common approaches that don't work:

  1. Disable CSRF protection 92% fail

    Cross-site request forgery vulnerability

  2. Set SameSite=None without Secure flag 85% fail

    Cookie sent over HTTP, session hijack risk