# Cross-Site Request Forgery (CSRF)

> Detects web forms and state-changing endpoints that lack CSRF token protection.

- Skill: `zakirkun/cross-site-request-forgery-csrf` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/cross-site-request-forgery-csrf`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/cross-site-request-forgery-csrf/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/cross-site-request-forgery-csrf

---


# Cross-Site Request Forgery (CSRF)

## Overview
CSRF tricks authenticated users into unknowingly submitting requests to a web application they're logged into. Without CSRF tokens, an attacker can craft a malicious webpage that triggers state-changing actions (password change, fund transfer, account deletion) in the victim's session.

## Detection Strategy
- HTML forms without CSRF token hidden input
- POST endpoints in Express/Flask/Go without CSRF middleware
- CORS policy that allows cross-origin requests with credentials

## Remediation
- Use framework CSRF protection middleware (csurf, Flask-WTF, Django CSRF, etc.)
- Verify `Origin` or `Referer` header for same-origin
- Use `SameSite=Strict` cookies as a defense-in-depth measure

**Vulnerable (HTML form):**
```html
<form method="POST" action="/transfer">
    <input name="amount" value="1000">
    <input type="submit">
</form>
```

**Safe:**
```html
<form method="POST" action="/transfer">
    <input type="hidden" name="_csrf" value="{{ csrf_token }}">
    <input name="amount" value="1000">
    <input type="submit">
</form>
```