What is the XSRF-TOKEN cookie?
Holds a cross-site request forgery (CSRF) protection token to keep form submissions secure. Strictly necessary.
Strictly necessary No consent needed
| Cookie name | XSRF-TOKEN |
|---|---|
| Also seen as | csrftokencsrf_token |
| Set by | Web framework (generic) |
| Category | Strictly necessary |
| Typical duration | session |
| Domain | first-party |
| Consent required? | No — strictly necessary |
Does XSRF-TOKEN need consent?
No. XSRF-TOKEN is treated as strictly necessary — it exists so the site can function securely (sessions, security or fraud prevention), not to track you across the web. Strictly necessary cookies are exempt from the consent requirement under ePrivacy, so a site may set XSRF-TOKEN without asking first. It should still be listed in the site's cookie policy.
Is XSRF-TOKEN a tracking cookie?
Required for the site to work — sessions, security, load balancing, cart state. Exempt from consent under ePrivacy.
How to see and remove XSRF-TOKEN
- See it: open your browser's developer tools → Application (Chrome/Edge) or Storage (Firefox) → Cookies, and look for
XSRF-TOKEN. - Remove it: clear cookies for the site, or use your browser's "Clear browsing data" for cookies. It will reappear if you keep using the site and consent is in place.
- Stop it being set: decline non-essential cookies on the site's banner. On a compliant site, clicking "Reject all" prevents non-essential cookies (this one is necessary, so it may still appear).
Want to know which cookies your site sets — and whether any fire before consent? Scan it free and get the full list, categorised, with the ones that load too early flagged.
Fixing pre-consent cookies
If a scan shows tracking cookies loading before the visitor consents, the fix is a consent management platform (CMP) that blocks non-essential tags until the visitor agrees. Cookies.ie is our GDPR / ePrivacy CMP — EU-hosted, with a real one-click "Reject all" and consent logging. See the fix guide for pre-consent trackers.
Related cookies
__cf_bm— Cloudflarecf_clearance— Cloudflare__stripe_mid— StripePHPSESSID— PHP (generic)
Cookie purposes and durations reflect vendor documentation and common consent databases as of 2026-06-25; a specific site may configure XSRF-TOKEN differently. This is general information, not legal advice.