Fixing Cross-Site Request Forgery (CSRF)
Vulnerability assessment details, CWE reference metrics, and complete code-level patches.
Threat Profile
Vulnerability Analysis
CSRF occurs when a malicious website causes a victim's web browser to perform an unwanted action on a trusted site where the victim is currently authenticated. Browsers automatically attach authentication cookies to requests, validating unauthorized actions.
How it is Detected
Identified by auditing state-changing requests (POST, PUT, DELETE) to check if they lack unique, validated CSRF tokens or SameSite cookie parameters.
Remediation Guidelines
Implement unique anti-CSRF tokens for every state-changing session request. Configure session cookies with the SameSite=Strict or SameSite=Lax attributes.
Remediation Script (Cookie configuration)
// SECURE REMEDIATION: Restricting cookie visibility
Set-Cookie: session_id=xyz123; Secure; HttpOnly; SameSite=LaxFrequently Asked Questions
How does SameSite mitigate CSRF?
SameSite tells the browser not to send cookies along with cross-site requests, blocking attackers from abusing the active session.
Are GET requests vulnerable to CSRF?
Yes. All state-changing requests must be protected, and GET requests must never alter application state.
What is an anti-CSRF token?
A unique, cryptographically secure value associated with the session that must be submitted inside request forms to verify user intent.
Related Vulnerability Profiles
SQL Injection (SQLi)
Attackers execute arbitrary SQL commands, bypassing authentication and manipulating database schemas.
Stored Cross-Site Scripting (Stored XSS)
Malicious scripts are stored on the server (e.g. database) and executed when users request the compromised resource.
Reflected Cross-Site Scripting (Reflected XSS)
Malicious scripts are reflected off the web server (e.g. search queries) and executed immediately in the user's browser.
DOM-based Cross-Site Scripting (DOM XSS)
Vulnerability where the client-side JavaScript processes inputs in an unsafe way (e.g. using eval or innerHTML).