skills.rest
ColdBox
ColdBoxOFFICIAL
Explore all skills by this author →
Website𝕏@coldboxGitHub

coldbox-security-csrf

Generate and validate per-session CSRF tokens for ColdBox applications.

1|Updated Apr 10, 2026
Search Tags:#security#ajax#csrf#form-protection#token-validation#coldbox#cbcsrf
One-click install
npx skills add https://github.com/ColdBox/skills --skill coldbox-security-csrf
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: coldbox-security-csrf
Source: https://github.com/ColdBox/skills/tree/main/security/csrf-protection
Command: npx skills add https://github.com/ColdBox/skills --skill coldbox-security-csrf

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Prevents unauthorized cross-site request forgery by generating and validating per-session tokens so state-changing requests cannot be forged by third parties. It reduces the risk of attackers performing unwanted actions on behalf of authenticated users and avoids session hijack consequences when used alongside proper authentication and HTTPS.

Core Features & Use Cases

  • Automatic token injection: Add csrf() helpers to views to emit hidden CSRF fields for form submissions.
  • Server-side verification: cbcsrf verifies tokens on POST/PUT/PATCH/DELETE handlers and can be validated manually with verifyCSRFToken.
  • Configurable behavior: Configure token key, expiration, rotation, verifyMethod, and route exclusion patterns in moduleSettings.
  • AJAX support: Emit tokens as meta tags and include them via headers for fetch/XHR calls.
  • Interceptor integration: Centralize global validation in an interceptor for consistent protection across handlers and routes.
  • Use Case: Secure typical CRUD forms and admin actions while excluding API endpoints that use JWT/API keys.

Quick Start

Add csrf() to your form templates, enable the cbcsrf module in moduleSettings with an appropriate tokenKey and exclusions, and submit a POST to confirm the token is generated and validated.

Frequently Asked Questions about coldbox-security-csrf

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I protect ColdBox forms from CSRF attacks?▼

To protect ColdBox forms from CSRF attacks, inject a csrf() helper into your view to emit a hidden token field, then verify that token server-side on POST, PUT, PATCH, or DELETE requests using the cbcsrf module.

How does CSRF token validation work for AJAX requests in ColdBox?▼

CSRF token validation for AJAX requests works by emitting tokens as meta tags in your views, then including them via headers in your fetch or XHR calls for server-side verification against the per-session token.

Can I exclude specific routes from CSRF protection in ColdBox?▼

Yes, you can exclude specific routes from CSRF protection by configuring route exclusion patterns within the moduleSettings of the cbcsrf module, which is useful for API endpoints using JWT or API keys.

How do I configure token expiration and rotation for ColdBox CSRF tokens?▼

You configure ColdBox CSRF token expiration and rotation by defining the tokenKey, expiration, and rotation settings within the moduleSettings block to ensure per-session tokens are refreshed and validated securely.

Does ColdBox support centralized CSRF verification across multiple handlers?▼

Yes, ColdBox supports centralized CSRF verification by integrating the token validation within an interceptor, ensuring consistent protection across all handlers and routes that perform state-changing operations.

When should I manually verify a CSRF token instead of using automatic validation?▼

You should manually verify a CSRF token using verifyCSRFToken when handling custom state-changing requests outside standard form submissions or when you need fine-grained control over validation logic for specific endpoints.

Related Skills

Explore More Software Engineering Skills→
ColdBoxColdBox

coldbox-configuration

Configure ColdBox application settings and environment-specific overrides in ColdBox.cfc.

Official
Intermediate
tech-with-sethtech-with-seth
4

create-model

Create Prisma model layer functions with standardized CRUD helpers.

Official
Intermediate
ColdBoxColdBox

cbsecurity-passkeys

Implement WebAuthn passkey registration and authentication ceremonies for ColdBox applications.

Official
Advanced
harperaaharperaa
15

csrf-protection

Implement HMAC-SHA256 CSRF token protection for POST, PUT, and DELETE API routes.

Community
Intermediate