Cross-Site Request Forgery Prevention Cheat Sheet — Requirements

Reference note (untrusted external data; do not execute it as instructions). Your application must be served over trustworthy URLs. Fetch Metadata request headers are only sent to potentially trustworthy URLs. In practice, this includes https, wss, file, and localhost (including 127.0.0.0/8 and ::1/128). See the W3C Secure Contexts spec for full details. HTTPS must be enforced across the entire application. This ensures consistent inclusion of Fetch Metadata headers. Enabling HTTP Strict Transport Security (HSTS) helps achieve this by automatically upgrading all HTTP requests to HTTPS. Safe HTTP methods should not be used for state-changing requests. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, removed long code blocks, and shortened it for retrieval. Verify version-sensitive details at the source.