What is the XSRF-TOKEN cookie?
XSRF-TOKEN isn't tied to a single vendor — it's a generic name used by many web frameworks and platforms (PHP, Java, .NET, Node.js applications, or other systems built on libraries that implement CSRF protection) to store a unique security token per session.
The cookie is set automatically by the application's server, usually as soon as a visitor loads a page containing a form, a login, or any other action that sends data back to the server (e.g. login, checkout, contact form, admin panel).
What data it stores
The cookie's value is typically a randomly generated alphanumeric string (a cryptographic token) with no direct link to the person's real identity. The exact format varies between applications, depending on the framework used.
This token is sent back to the same server, usually in an HTTP header of subsequent requests, so it can be compared against the value expected by the application. The data is generally not sent to third parties — it only travels between the visitor's browser and the server that issued the token.
What it is used for
The main purpose is security: the XSRF-TOKEN allows the application to verify that a request (such as submitting a form or performing an account action) genuinely comes from the user's legitimate session, rather than from a malicious site trying to trigger actions on the user's behalf without their knowledge.
For the site owner, this cookie directly supports the correct and secure operation of forms, authentication, and any sensitive action within the application.
Does it require consent?
XSRF-TOKEN is classified as a strictly necessary cookie, since it serves a technical security function essential to the application's correct operation and is not used for analytics or marketing.
- Under Article 5 of Romania's Law 506/2004 (transposing the ePrivacy Directive) and ANSPDCP's interpretation, strictly necessary cookies may be set without the visitor's prior consent.
- The site owner should still list it in the cookie policy, with its actual purpose and duration, for GDPR transparency.
How to block or delete XSRF-TOKEN
A visitor can delete or block XSRF-TOKEN from their browser settings (Chrome, Firefox, Edge, Safari — per-site cookie management), but blocking it may break forms, login, or other protected features of the site.
Because it's strictly necessary, a CMP should not and typically does not block this cookie before consent — blocking applies only to statistics, marketing, or preferences cookies. A platform like CookieFix can automatically scan a site's scripts and, by default, block only the categories that actually require consent, leaving strictly necessary cookies like XSRF-TOKEN to function normally.
Frequently asked questions
It's set by the web application itself (the site's server), not by one specific external vendor, since "XSRF-TOKEN" is a generic name used by many frameworks for CSRF protection.
No, it's a technical security cookie. It isn't used for profiling, advertising, or behavioral analytics.
No, since it's strictly necessary for the site to function securely, it can be set without prior visitor consent, but it should still be disclosed in the cookie policy.
Forms, login, or other protected actions on the site may fail or show security errors, because the server can no longer verify the authenticity of the request.