Comparison
Cross-site request forgeryvsSession cookie
Cross-site request forgery
another site makes the user's browser send an authenticated request to yours, and the cookie goes along automatically.
An attack exploiting the browser's habit of attaching cookies to cross-origin requests, so a third-party page can act as a logged-in user. Defences are `SameSite` cookies, a synchroniser token, and not accepting state-changing GETs. It does not apply to APIs authenticated by an `Authorization` header, because nothing attaches those automatically.
Full entry →Session cookie
you give the browser an opaque id and keep the actual session state on the server, so logging someone out is one delete.
An identifier referencing server-held session state. Revocation is immediate and the client learns nothing, which is exactly what stateless tokens give up. The cost is a lookup per request and shared session storage across instances; the flags — `HttpOnly`, `Secure`, `SameSite` — are what make it safe in a browser.
Full entry →