Update: CSRF Cheat Sheet

[cronchie]

What is missing or needs to be updated?

This sentence is correct but misleading:

IMPORTANT: Remember that Cross-Site Scripting (XSS) can defeat all CSRF mitigation techniques!

It can imply a corollary that CSRF mitigations are unnecessary in the presence of XSS protections, which isn't what we want.

How should this be resolved?

Proposing instead:

While Cross-Site Scripting (XSS) vulnerabilities can bypass CSRF protections, CSRF tokens are still essential for web applications that rely on cookies for authentication. Consider the client and authentication method to determine the best approach for CSRF protection in your application.

[jmanico]

Let's go PR, I like this a lot