What you need to know
A malicious site can sometimes cause a signed-in browser to submit a request to another site. SameSite cookies help, but sensitive flows may need additional defenses based on the application's setup.
How to apply it
Use secure cookie settings, validate origin or referer where appropriate, and add an anti-CSRF token for state-changing requests when required by the framework or auth design.
Common mistake to avoid
Do not rely on CORS alone to prevent CSRF. Confirm how your authentication provider handles cross-site requests.