Validating CSRF Protection

Overview

Validate Cross-Site Request Forgery protection across web application endpoints, forms, and API routes. This skill examines synchronizer token patterns, double-submit cookie implementations, SameSite cookie attributes, Origin/Referer header validation, and custom header requirements to identify state-changing operations vulnerable to CSRF attacks.

Prerequisites

• Access to the target codebase and configuration files in ${CLAUDE_SKILL_DIR}/
• Familiarity with the web framework in use (Express, Django, Rails, Spring, Laravel, etc.)
• Standard shell utilities and Grep/Glob available for codebase scanning
• Reference: ${CLAUDE_SKILL_DIR}/references/README.md for CSRF protection methods, OWASP CSRF Prevention Cheat Sheet, and framework-specific API examples

Instructions