Validate CSRF protection implementations for security gaps. Use when reviewing form security or state-changing operations. Trigger with 'validate CSRF', 'check CSRF protection', or 'review token security'.
npxskills add jeremylongshore/claude-code-plugins-plus-skills--skill validating-csrf-protectionLoading…
Validate Cross-Site Request Forgery protection across web application endpoints, forms, and API routes. This skill examines synchronizer token patterns, double-submit cookie implementations, SameSite cookie attributes, Origin/Referer header validation, and custom header requirements to identify state-changing operations vulnerable to CSRF attacks.
${CLAUDE_SKILL_DIR}/${CLAUDE_SKILL_DIR}/references/README.md for CSRF protection methods, OWASP CSRF Prevention Cheat Sheet, and framework-specific API examplesSecure and attributes, and the comparison is timing-safe to prevent token extraction.HttpOnlySameSite=Strict or SameSite=Lax is set. Flag SameSite=None without Secure as severity high. Note that SameSite=Lax permits top-level GET navigations, which may be insufficient for GET endpoints that trigger state changes.Origin header against an allowlist on state-changing requests. Flag implementations that fall back to no protection when the header is absent.Content-Type enforcement), and Flash/Silverlight crossdomain.xml files.csurf for Express, @csrf_protect for Django, csrf_meta_tags for Rails)| Error | Cause | Solution |
|---|---|---|
| No state-changing endpoints found | Unconventional routing patterns or SPA architecture | Check for client-side routing frameworks (React Router, Vue Router) and trace API calls from frontend code |
| CSRF middleware detected but not applied globally | Middleware applied per-route rather than globally | Verify every state-changing route has the middleware applied; flag gaps in coverage |
| Token generation source unclear | Framework abstracts CSRF token generation | Check framework documentation for default CSPRNG usage; inspect framework source if needed |
| SameSite attribute not set in code | Cookie attributes set at infrastructure layer | Check reverse proxy, load balancer, or CDN cookie rewriting rules |
| Mixed protection strategies | Different endpoints use different CSRF mechanisms | Document each strategy and verify consistency; recommend standardizing on one approach |
Scan ${CLAUDE_SKILL_DIR}/src/routes/ for router.post and router.put handlers. Verify
each includes csurf middleware or equivalent token validation. Flag any POST
handler that directly processes req.body without csrfProtection middleware
as CWE-352, severity critical for financial operations, high for other state changes.
Grep ${CLAUDE_SKILL_DIR}/settings.py for django.middleware.csrf.CsrfViewMiddleware in
the MIDDLEWARE list. Scan views for @csrf_exempt decorators -- flag each
exempted view as a potential CSRF vulnerability requiring justification. Verify
templates include {% csrf_token %} in all form tags.
For a React frontend calling a REST API, verify that the API enforces a custom
header requirement (e.g., X-Requested-With) or uses double-submit cookies.
Check that the SPA reads the CSRF token from a cookie and includes it in the
X-CSRF-Token header. Flag API endpoints that accept application/x-www-form-urlencoded
without CSRF validation as severity high (exploitable via HTML forms).
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).