SEC-003CSRF tokens without a frameworkOne token per session, compared in constant time, checked on every state-changing POST. Twenty lines and no dependency.PHPTested on PHP 8.2, MariaDB 10.6