Implement CSRF prevention with SameSite cookies, tokens, and origin validation.
npx skills add https://github.com/hung-phan/system-skills --skill csrf-hung-phan
Please help me install this Agent Skill. Skill: csrf Source: https://github.com/hung-phan/system-skills/tree/main/skills/system-review/references/security/csrf Command: npx skills add https://github.com/hung-phan/system-skills --skill csrf-hung-phan
This Skill helps to prevent Cross-Site Request Forgery (CSRF) attacks, which are used by attackers to exploit web applications by tricking users into performing unintended actions without their knowledge.
Use the csrf skill to check if your session cookie has the correct SameSite attribute for protection against CSRF attacks.
High-intent search queries and answers about installing and using this skill.
To prevent CSRF attacks, this Skill implements SameSite cookies, synchronization tokens, double-submit cookies, and origin header validation to block cross-site request forgery attempts effectively.
Validating Origin and Referer headers for CSRF protection involves checking these headers to prevent cross-site requests from executing harmful actions, which this Skill configures alongside other defense mechanisms.
Implementing synchronization tokens and double-submit cookies for session security requires integrating server-side authentication mechanisms with cookie handling, applying token patterns to verify request legitimacy.
You can use SameSite cookie attributes to protect against cross-site request forgery by applying the attribute to session cookies, preventing them from being sent with cross-site requests.
This CSRF prevention approach works with python-social-auth and presigned-cookies dependencies, requiring configuration and integration with server-side authentication mechanisms and cookie handling to function.
Avoiding state changes on GET requests adheres to RESTful design principles and prevents Get Mutation, which is a specific CSRF vulnerability vector where state-altering actions are exposed via safe HTTP methods.
lucasnobreeSet server-side cookies in Next.js via client components and server actions.
ImL1sIntegrates Google and Apple Sign-In with Firebase Authentication in Flutter apps.
dennislee928Integrate Firebase Authentication with email/password, OAuth, phone, and MFA.
CleanExpoImplement CSRF protection with token validation and header checks for Next.js and FastAPI.
