CSRF token and Origin gaps
Cookie-auth state change without a token the browser cannot set. SameSite=Lax is not the whole story.
Tags: csrf, samesite, ato
Techniques
Drop the token
Omit CSRF header/body. If the action still runs, the check is optional.
POST without csrf / x-xsrf-token
Origin vs Referer
Null Origin, https://target.com.evil, and a missing Origin on a form POST.
Origin: nullOrigin: https://target.example.evil.example
content-type skip
text/plain or text/plain; charset=utf-8 JSON that the API still parses, no preflight.
Content-Type: text/plain with {"email":"attacker@evil.example"}
Subdomain cookie
Session on .target.com plus an XSS or open redirect on a sibling host.
form POST from the sibling origin with credentials