A Token Proves the Form Came From Your Own Page
I remember being woken up at 3:00 AM by a frantic client whose admin dashboard had been hijacked, not by some Hollywood-style brute force attack, but by something much more mundane. They had fallen victim to a cross site request …