CSRF attacks are now prevented via a stateless method that uses [browser Fetch metadata](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Sec-Fetch-Site), anti-CSRF tokens are therefore no longer used as such the `CSRF_COOKIE_HTTP_ONLY` option was removed. Because it is stateless, you can now submit work on tabs that have been open for more than 24 hours. The browser Fetch metadata are supported by all major browsers since 2020 and Safari since  2023, the verification falls back to using the `Host` and `Origin` header if no Fetch metadata is sent. Forgejo instances that are hosted on a subpath are no longer protected against CSRF attacks from services that are hosted on the same origin (same scheme, host/domain and port).
