0
I'm currently working on an implementation of a csrf protection.
My question is : what is the best practice when we detect a CSRF ?
Is it better to 404 the page, 403 (forbidden), 200 (OK) with an error message, something else ?
My code is below. I'm not very proud of the preg_replace and ob_*...