What is the _csrf cookie?
_csrf is a generic cookie name used by numerous server-side frameworks and web applications, regardless of programming language, as part of their anti-CSRF protection mechanism. It is not tied to a single third-party provider; it is set directly by the visited website itself (a first-party cookie) as part of the application's internal logic.
It typically appears on the first load of a page containing a form (login, checkout, contact form, admin panel) or when an authenticated session starts. The exact name and behavior can vary slightly depending on the framework the site uses.
What data it stores
The stored value is usually a random token generated by the server (a unique string with no inherent meaning), meant only to be matched against an identical token submitted with the form or in a request header. It does not contain a name, email, or other personal data directly, although it is technically tied to the user's session.
The cookie is sent only to the first-party domain that set it, with each request to the server, to validate form submissions and sensitive actions (submitting, deleting, or modifying data).
What it is used for
Its sole purpose is application security: it prevents a malicious third-party site from submitting requests to the visited site on behalf of an authenticated user without their knowledge (for example, changing a password or making a payment).
For the site owner, _csrf is an essential building block for the safe operation of forms and authenticated areas — not an analytics or marketing tool.
Does it require consent?
Under CookieFix's classification, _csrf falls into the strictly necessary category. Since it is essential for the site's basic functioning and security (without it, forms may be vulnerable to CSRF attacks), it does not require prior visitor consent, in line with the ePrivacy Directive's exemption for cookies "strictly necessary to provide a service explicitly requested" by the user (in Romania, transposed via Law 506/2004).
- It still needs to be listed in the site's cookie policy, with its actual purpose and duration.
- It should not be placed in categories requiring active opt-in (statistics, marketing, preferences).
- Site owners should confirm it expires with the session or within a short window consistent with its security purpose.
How to block or delete _csrf
A visitor can delete or block this cookie from browser settings (Chrome, Firefox, Edge, Safari – the site-level cookie management section). Blocking it, however, may cause form submission errors or login failures, since it is essential for the site to function correctly.
Because it is strictly necessary, it should not be blocked pending consent by a consent management platform. A CMP like CookieFix is configured to let strictly necessary scripts and cookies run freely, automatically blocking until consent only the scripts from categories that actually require visitor approval (statistics, marketing, preferences).
Frequently asked questions
No. It is strictly necessary for site security, so it is exempt from the prior consent requirement under the ePrivacy Directive, but it must still be disclosed in the cookie policy.
Site forms (login, contact, checkout) may fail to submit or show session errors, because the server can no longer validate the request.
No. Its value is a random security token, not an identifier used for profiling or statistical analysis.
It is set directly by the visited website (first-party), as part of the server-side framework or application in use, not by an external provider.