Update: Table of Contents for CSRF Cheat Sheet

[mkhanas]

What is missing or needs to be updated?

With the addition of the Fetch Metadata section, the CSRF Cheat Sheet has become somewhat harder to navigate. Currently, recommended mitigation patterns are mixed in the middle of the table of contents, which may make it less clear for developers to quickly find core recommendations.

The list in the Introduction section may also need updating to reflect any reordering.

This was brought up as part of the Update Fetch Metadata positioning PR, and it was decided to create a separate issue to discuss possible updates.

How should this be resolved?

The structure could look more like this:

## Disallowing Simple Requests
## Token-Based Mitigation
...
## Fetch Metadata Headers
## Dealing with Client-Side CSRF Attacks
## Defense In Depth Techniques

We discussed this as a possible high-level structure, but there are definitely other improvements to be made, especially at the subsection level, to improve clarity and prioritisation of the content.