"Browsers default to Lax now"
The team removed CSRF tokens, reasoning that modern browsers default SameSite to Lax and that covers it.
A test lands a cross-site POST that moves money — reproducible only in the couple of minutes right after sign-in. The defaulted Lax behaviour is more permissive than an explicit one: a freshly-set cookie is still sent on a cross-site top-level POST for a short window.
Add the control that actually stops a forged request.
Components — tap one, then tap a slot on the diagram
!A page on another domain just moved money out of a logged-in account.
Outside every boundary: Attacker page (cross-site POST), Real form (same-site), POST /transfer (FAILED: forged request), an empty slot for the verify per request Connections: Real form calls verify per request — carries a valid token (step 1) verify per request calls POST /transfer (step 2) Attacker page must NOT reach verify per request — no valid token
Attacker pagecross-site POST
Real formsame-site
POST /transferforged request