What is the __csrf_token cookie?
__csrf_token is not tied to a single provider — it's a generic name used by numerous web frameworks and platforms (PHP, Node.js, and Python applications, content management systems, checkout forms, and more) as part of their built-in CSRF protection.
It is set by the website's own server (first-party) as soon as a visitor loads a page containing a form — login, checkout, contact, or any action that submits data back to the server.
What data it stores
The cookie stores a unique, randomly generated token tied to the current browsing session. The value is typically an alphanumeric string with no meaning to the visitor and no connection to their real identity.
The data stays with the site's own server; the cookie is not shared with third parties and has no tracking or profiling function.
What it is used for
Its purpose is purely security-related: the server checks, at each form submission, that the received token matches the one issued for that session, blocking forged requests sent from other websites (CSRF attacks).
Without this cookie, features such as login, online payment, or contact forms would be vulnerable to external manipulation.
Does it require consent?
In CookieFix's classification, __csrf_token is categorized as strictly necessary. Under Article 5(3) of the ePrivacy Directive (transposed in Romania via Law 506/2004) and ANSPDCP's guidance, cookies strictly necessary to deliver a service explicitly requested by the user do not require prior consent.
Site owners should still list it in their cookie policy, along with its purpose and duration, for GDPR transparency.
How to block or delete __csrf_token
Visitors can delete or block this cookie from their browser settings, but the effect is immediately noticeable: forms relying on it (login, checkout, contact) will fail or show security errors, since the server can no longer validate the request.
- Chrome/Edge: Settings → Privacy and security → Cookies
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Preferences → Privacy
Since it's strictly necessary, site owners shouldn't block this cookie pending consent — a CMP like CookieFix automatically excludes it from the blocking layer, placing it in the necessary category, while still blocking statistics and marketing scripts until the visitor consents.
Frequently asked questions
It's a technical cookie that stores a unique token the server uses to verify that forms submitted from the site are authentic, preventing CSRF attacks.
No. As a cookie strictly necessary for secure site functionality, it falls outside the ePrivacy/GDPR consent requirement, but it must still be listed in the cookie policy.
It's set by the visited site's own server (first-party), not by an external provider — the name is used generically across many web frameworks.
Forms that depend on it (login, checkout, contact) may fail or show validation errors, since the server can no longer confirm the request is legitimate.