A forged POST that purged our entire CDN cache
Last spring I watched the LiteSpeed page-cache hit ratio on DailyWatch fall off a cliff for twenty minutes. Nothing had deployed. No cron had fired. What actually happened was dumber and scarier than any of that: a bookmarked browser tab, still logged into our admin panel, loaded an unrelated forum page, and that page auto-submitted a hidden HTML form to /ibt/purge-cache. The browser dutifully attached our session cookie, the origin saw a perfectly authenticated request, and the entire edge cache evaporated. Rebuild traffic hammered SQLite for the next half hour.
That is Cross-Site Request Forgery. If your PHP video admin panel authenticates state-changing actions — approve a video, rewrite metadata, purge cache, trigger a re-fetch — using nothing but a session cookie, you have exactly the same hole. The browser sends your cookie on any request to your origin, including requests initiated by a page you don't control. Authentication is not authorization of intent.
This post walks through the pattern I settled on: signed double-submit cookies. It's stateless, it plays nicely with an aggressive page cache, and it fits a PHP 8.4 codebase without dragging in a framework.
