Catalog/VULNERABILITY/csrf
SCAN-ID: CSRFREVISION 2026.4
VULNERABILITYCVSS 6.5 (MEDIUM)

CSRF Protection Scanner

Verify anti-CSRF tokens, SameSite cookie policies, and origin validation on sensitive state-changing routes.

Technical Scope & Verification Behavior

Tests POST/PUT/DELETE forms and endpoints for missing CSRF tokens, lax cookie flags, and cross-site submission acceptance.

Automated Inspection Checks (7)
Passive URL parameter fuzzing
Non-destructive boundary tests
Header & cookie flag assertions
Differential latency timing

Proof of Concept (PoC) Vector

Canonical test payload dispatched during security surface audits.

POST /api/user/email without X-CSRF-Token

Probe Execution Simulator

Watch the probe engine test this signature in an isolated sandbox.

probe-runner (isolated ephemeral container)
Click 'Simulate Check' to watch the headless audit engine test this vector.

Remediation Patch

SameSite Strict Cookie Setting

patch.diff (typescript)
--- a/handler.typescript (Vulnerable)
Set-Cookie: session=xyz; Path=/;
+++ b/handler.typescript (Remediated)
Set-Cookie: session=xyz; Path=/; HttpOnly; Secure; SameSite=Strict;

Set SameSite=Strict or Lax and verify custom CSRF headers on mutating requests.

AI Agent Prompt (Cursor · Claude · Copilot)

Copy and paste into your editor to refactor this issue automatically.

"Add anti-CSRF token verification and set SameSite=Strict on all authentication cookies."

Run Isolated Check

Test your public domain specifically for CSRF Protection Scanner.

100% passive • No server load

Specification Details

CVSS Score
6.5 / 10.0
Severity Level
MEDIUM
Category
VULNERABILITY
Test Vectors
7 automated
Execution SLA
< 2.5 seconds
False Positive Defense
Strict assertion
Related Standards
#CSRF#Cookies#SameSite#OWASP A01

Run continuous monitoring for CSRF Protection Scanner

Audit your site across all 41 vectors automatically on every deploy.

Back to Catalog