csrf

Implement CSRF prevention with SameSite cookies, tokens, and origin validation.

Updated Jun 5, 2026

Search Tags:#web security #csrf #request validation #cookie attributes #form tokens

Ready to run

npx skills add https://github.com/hung-phan/system-skills --skill csrf-hung-phan

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: csrf
Source: https://github.com/hung-phan/system-skills/tree/main/skills/system-review/references/security/csrf
Command: npx skills add https://github.com/hung-phan/system-skills --skill csrf-hung-phan

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires https://github.com/python-social-auth/social-auth-core, https://github.com/peterhayes/presigned-cookies, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill helps to prevent Cross-Site Request Forgery (CSRF) attacks, which are used by attackers to exploit web applications by tricking users into performing unintended actions without their knowledge.

Core Features & Use Cases

SameSite Cookie Protection: Applies the SameSite attribute to session cookies to prevent them from being sent with cross-site requests.
Token Defense Mechanism: Implements synchronization token patterns, double-submit cookies, or custom-header-with-preflight for secure authentication.
Origin/Referer Header Validation: Validates the Origin/Referer headers to prevent cross-site request from executing harmful actions.
Get Mutation Avoidance: Prevents state changes on GET requests, adhering to RESTful design principles.
Re-authentication for High-Value Actions: Protects critical actions such as account deletion and money transfers with additional re-authentication.

Quick Start

Use the csrf skill to check if your session cookie has the correct SameSite attribute for protection against CSRF attacks.

Frequently Asked Questions about csrf

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prevent CSRF attacks in my web application?▼

To prevent CSRF attacks, this Skill implements SameSite cookies, synchronization tokens, double-submit cookies, and origin header validation to block cross-site request forgery attempts effectively.

What is the best way to validate Origin and Referer headers for CSRF protection?▼

Validating Origin and Referer headers for CSRF protection involves checking these headers to prevent cross-site requests from executing harmful actions, which this Skill configures alongside other defense mechanisms.

How do I implement synchronization tokens and double-submit cookies for session security?▼

Implementing synchronization tokens and double-submit cookies for session security requires integrating server-side authentication mechanisms with cookie handling, applying token patterns to verify request legitimacy.

Can I use SameSite cookie attributes to protect against cross-site request forgery?▼

You can use SameSite cookie attributes to protect against cross-site request forgery by applying the attribute to session cookies, preventing them from being sent with cross-site requests.

Does this CSRF prevention approach work with python-social-auth and presigned-cookies?▼

This CSRF prevention approach works with python-social-auth and presigned-cookies dependencies, requiring configuration and integration with server-side authentication mechanisms and cookie handling to function.

Why should I avoid state changes on GET requests for web security?▼

Avoiding state changes on GET requests adheres to RESTful design principles and prevents Get Mutation, which is a specific CSRF vulnerability vector where state-altering actions are exposed via safe HTTP methods.