Good comment. To expand on this in particular, as I haven't seen anyone else mention it:
> Do forms set a cross-site request forgery cookie?
Some legitimate forms of CSRF mitigation do utilize a cookie, but the checklist is dangerously misleading as worded. An anti-CSRF token in a cookie will do absolutely nothing on its own - it needs to either be in a header or the DOM, as you mentioned.
Any forged request an attacker compels a victim to send will include all cookies, not just the session cookie, rendering this protection useless.
Comments
Good comment. To expand on this in particular, as I haven't seen anyone else mention it:
> Do forms set a cross-site request forgery cookie?
Some legitimate forms of CSRF mitigation do utilize a cookie, but the checklist is dangerously misleading as worded. An anti-CSRF token in a cookie will do absolutely nothing on its own - it needs to either be in a header or the DOM, as you mentioned.
Any forged request an attacker compels a victim to send will include all cookies, not just the session cookie, rendering this protection useless.