Implement CSRF protection

Add CSRF protection to a [Language/Framework] web application that uses session-based authentication. Implement either the synchronizer token pattern with a per-session or per-request token, or the double-submit cookie pattern, or rely on SameSite=Strict cookie attributes — explain the trade-offs. Show the server-side middleware or filter that validates the token. Demonstrate how the token is embedded in HTML forms and included in AJAX request headers. Write at least two tests that confirm a cross-origin request without the correct token is rejected.