What is the csrf_cookie_name cookie?
csrf_cookie_name is the generic name CodeIgniter (a PHP framework used to build websites and web applications) assigns by default to its CSRF protection cookie. Site owners can rename this cookie in their configuration, but "csrf_cookie_name" remains the standard label used throughout the framework's documentation and source code.
The cookie is set by the server itself (not by a third-party script) the moment a visitor loads a page containing a CSRF-protected form – for example a login, contact, or checkout form. It therefore only appears on sites built with CodeIgniter that have CSRF protection enabled.
What data it stores
The cookie stores a randomly generated token that must match an identical hidden field submitted with the HTML form. The exact value format can vary depending on the CodeIgniter version and the project's configuration, but it essentially contains only a unique session/form identifier, with no personally identifiable information.
The value is read and validated exclusively by the server that generated it (the CodeIgniter application on the site); it is not shared with third parties and is not used for tracking or advertising purposes.
What it is used for
The cookie's role is to prevent CSRF attacks, where a malicious site could try to submit requests to the target application on behalf of an authenticated user (e.g., changing a password or making a payment) without their knowledge. By comparing the token in the cookie with the one in the submitted form, the application verifies the request genuinely originated from the form displayed on the site, not from an external source.
For the site owner, this cookie is part of the application's security mechanism, not an analytics or marketing tool.
Does it require consent?
In CookieFix's classification, csrf_cookie_name falls under strictly necessary. Under the GDPR and the ePrivacy Directive (transposed in Romania via Law 506/2004), cookies strictly necessary for a service explicitly requested by the user (here, securely submitting a form) do not require prior consent.
- No opt-in is needed in the consent banner.
- It should still be listed, with its purpose and duration, in the site's cookie policy for transparency.
- Site owners should not block it via a CMP, since disabling it can break form submissions.
How to block or delete csrf_cookie_name
A visitor can delete or block this cookie from their browser settings (Chrome, Firefox, Safari, Edge – site-specific cookie management), but doing so may trigger "invalid CSRF token" errors when submitting forms, since the cookie is required for the page to function correctly.
Because it is strictly necessary, a CMP such as CookieFix should not block this cookie before consent, unlike statistics or marketing cookies, which it can keep blocked automatically until the visitor gives consent.
Frequently asked questions
It's a technical cookie set by the CodeIgniter PHP framework to protect a website's forms against CSRF (Cross-Site Request Forgery) attacks.
No. It isn't used for analytics, advertising, or profiling — only for securely validating form submissions.
No, it's classified as strictly necessary and can be set without prior consent, but it must still be disclosed in the site's cookie policy.
CSRF-protected forms on the site (login, contact, checkout, etc.) may fail to submit, since the server can no longer verify the request's authenticity.