Stricter CSRF checks

[benmccann]

Describe the problem

We'd like to make CSRF checks even stricter, but it could potentially be a breaking change

Describe the proposed solution

Block more requests

Alternatives considered

No response

Importance

nice to have

Additional Information

No response

[teemingc]

@benmccann do you remember what this is supposed to look like more concretely?

[brunnerh]

I doubt that changes are necessary. Browsers no longer just send cookies everywhere, unless you explicitly allow it via CORS headers or when setting the cookie.

[benmccann]

I'll DM you

[Rich-Harris]

I don't know what's being suggested here

[benmccann]

I believe Tee answered on Discord. Ping me there if further clarification is needed