Verify anti-CSRF tokens, SameSite cookie policies, and origin validation on sensitive state-changing routes.
Tests POST/PUT/DELETE forms and endpoints for missing CSRF tokens, lax cookie flags, and cross-site submission acceptance.
Canonical test payload dispatched during security surface audits.
POST /api/user/email without X-CSRF-TokenWatch the probe engine test this signature in an isolated sandbox.
SameSite Strict Cookie Setting
Set-Cookie: session=xyz; Path=/;
Set-Cookie: session=xyz; Path=/; HttpOnly; Secure; SameSite=Strict;
Set SameSite=Strict or Lax and verify custom CSRF headers on mutating requests.
Copy and paste into your editor to refactor this issue automatically.
Test your public domain specifically for CSRF Protection Scanner.
Checks commonly evaluated alongside CSRF Protection Scanner during surface discovery.
Detect SQL injection vulnerabilities in your web application before attackers exploit database access.
Find XSS vulnerabilities that could let attackers inject malicious scripts and steal customer sessions.
Detect exposed API keys, private tokens, and cloud secrets in client-side bundles and public responses.
Audit your site across all 41 vectors automatically on every deploy.