anchor.diff:      }
   }
   ----
  -
   <1> Compare the CSRF form field and cookie values and fail with HTTP status `400` if they don't match.
   
   Also disable the token verification in the filter:
  
positive.code: implementation("io.quarkus:quarkus-csrf-reactive")
  ----
  
  Next lets add a Qute template producing an HTML form:
  
  [source,html]
  ----
  
negative.code: 
  include::./attributes.adoc[]
  
  https://owasp.org/www-community/attacks/csrf[Cross-Site Request Forgery (CSRF)] is an attack that forces an end user to execute unwanted actions on a web application in which they are currently authenticated.
  
  Quarkus Security provides a CSRF prevention feature which consists of a xref:resteasy-reactive.adoc[RESTEasy Reactive] server filter which creates and verifies CSRF tokens and an HTML form parameter provider which supports the xref:qute-reference.adoc#injecting-beans-directly-in-templates[injection of CSRF tokens in Qute templates].
  
  == Creating the Project
  
  