csrf-cross-site-request-forgery

To test for CSRF vulnerabilities in cookie-based web applications, identify high-value state-changing endpoints like password or email changes, then validate anti-CSRF token presence and behavior to uncover bypass techniques.

You can test SameSite bypass techniques by probing cross-origin cookie behaviors and edge cases in SameSite policies, checking whether state-changing web flows remain vulnerable despite SameSite cookie restrictions.

CSRF testing for JSON endpoints and OAuth involves validating JSON CSRF vectors and checking for missing or misused OAuth state parameters, crafting redirect scenarios to expose authorization vulnerabilities.

The best way to validate anti-CSRF token bypass techniques is to test token absence, validation flaws, and dual-submit patterns across state-changing web flows to confirm misconfigurations.

Yes, this CSRF testing methodology applies to login CSRF and referrer validation by providing a guidance checklist that tests referer validation, CORS misconfigurations, and other defense mechanisms.

A CSRF playbook is needed to systematically enumerate CSRF vectors, guiding testers through token bypass, SameSite bypass, JSON CSRF, and OAuth state checks to validate web application defenses.