This post covers how a CSRF attack works, and the defaults Phoenix gives you to discourage writing vulnerable code. https://paraxial.io/blog/csrf-intro