1
1. Revelant action (CSRF in logout is a meme fr)
2
2. Cookie-based session handling (be aware about JWT)
3
3. No unpredictable request parameters (if an attacker needs to know the value of the parameter, bye)

1
- Remove CSRF token from request, replace with random value or blank space
2
- Change POST to GET
3
- Replace CSRF token with an already used token
4
- Bypass regex
5
- Get a token by request and call manually
6
- Extract the token with XSS or HTML injection

1
CSRF tokens:
2
- Change HTTP request's methods
3
- Remove the entire token parameter
4
- Use a valid token and feed that token to the victim
5
- Try to find any behavior that allows to set a cookie in a victim's browser
6
- Try to find any functionality that contains cookie's setting's
7

8
SameSite cookies:
9
- If the value is `SameSite=None` it's worth investigating whether it's of any use
10
- Lax bypass via method override/http verb tampering
11
- Strict bypass via on-site gadget (like CSPT + OPEN REDIRECT to CSRF action)

1
. Use CSRF tokens
2
. Use Strict or Lax SameSite cookie restrictions
3
. Be wary of cross-origin, same-site attacks