Cross site request forgery (csrf) protection for web browsers

A method, for an application program interface (API) gateway, the method comprising:

• receiving data comprising session properties associated with a client device, the data further comprising an indicator associated with a secret value, the secret value being associated with an internal secret utilized to generate a session to provide services for the client device;
• transmitting the data and the secret value;
• receiving an operation request to perform a first operation;
• determining whether or not the secret value is received along with the operation request, based at least in part on the indicator;
• and
• performing the first operation based at least in part on the secret value being received along with the operation request, or a second operation based at least in part on the secret value not being received along with the operation request.

A mobile device executing a web browser, the mobile device comprising:

• one or more processors;
• and
• one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• transmitting a first request with an indicator, the indicator being utilized to generate a cookie associated with a secret value, the secret value being associated with an internal secret utilized to generate a session to provide services for the mobile device;
• receiving a response, the response comprising the cookie and the secret value, the cookie comprising an attribute flag associated with the secret value;
• and
• transmitting a second request to perform an operation, the second request comprising the cookie with the attribute flag, the operation being performed based at least in part on the attribute flag and the secret value being transmitted along with the second request.