csrf-protection

Cross-site request forgery (CSRF) protection secures API endpoints by enforcing cryptographic tokens that verify requests originate from your application, not malicious third-party sites. Apply CSRF middleware to POST, PUT, and DELETE endpoints to block unauthorized cross-origin requests automatically.

HMAC-SHA256 token validation uses industry-standard cryptographic signing to make tokens tamper-proof and forgery-resistant, while standard cookies alone can be exploited. This Skill combines HMAC-SHA256 tokens with HTTP-only cookies and SameSite=Strict to prevent both token interception and cross-origin request acceptance.

Yes. This Skill implements single-use session-bound tokens that expire after one use, rendering intercepted tokens useless. Each new request requires a fresh token exchange, eliminating replay attacks while maintaining session integrity across POST, PUT, and DELETE operations.

This Skill handles automatic token rotation through middleware enforcement and client-token exchange workflows. Tokens are generated session-bound and rotate after each use, requiring no manual intervention while satisfying cryptographic signing and verification requirements.

Yes, clients must participate in the token exchange workflow. The Skill provides middleware enforcement on the server; clients receive tokens via HTTP-only cookies and must include them in request headers for POST, PUT, and DELETE operations to pass verification.

SameSite=Strict prevents the browser from sending cookies on cross-site requests, blocking cookie-based attacks even if tokens are compromised. Combined with HMAC-SHA256 tokens and HTTP-only cookies, it creates defense-in-depth against cross-origin request forgery and related exploits.