skills.rest
ShadowAUS
ShadowAUSCOMMUNITY
Explore all skills by this author →
GitHub

csrf-protection

Implement token-based CSRF defenses for web forms and API routes.

Updated Aug 27, 2026
Search Tags:#security#middleware#tokens#web#csrf#cookies#samesite
One-click install
npx skills add https://github.com/ShadowAUS/chez-king-portal --skill csrf-protection-shadowaus
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: csrf-protection
Source: https://github.com/ShadowAUS/chez-king-portal/tree/main/.tessl/tiles/secondsky/claude-skills/plugins/csrf-protection/skills/csrf-protection
Command: npx skills add https://github.com/ShadowAUS/chez-king-portal --skill csrf-protection-shadowaus

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Cross-site request forgery (CSRF) attacks enable unauthorized state-changing actions. This Skill provides a multi-layer defense to help secure web forms and endpoints.

Core Features & Use Cases

  • Synchronizer Token: Hidden form field validated server-side.
  • Double Submit Cookies: Cookie + header must match to authorize requests.
  • SameSite Cookies: Browser enforces restrictions to block cross-origin requests.
  • Use Case: Protect login, transfers, and sensitive actions in both server-rendered and single-page apps.

Quick Start

Configure your forms to include a CSRF token and verify it on the server with a middleware.

Frequently Asked Questions about csrf-protection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add CSRF protection to web applications using synchronizer tokens?▼

You implement CSRF protection by configuring forms to include a synchronizer token and verifying it on the server with middleware. This hidden field is validated server-side to prevent unauthorized actions.

What is the best way to secure API routes from CSRF attacks?▼

Secure API routes by implementing double-submit cookies alongside middleware validation, ensuring the cookie and header values match before authorizing state-changing endpoint requests.

Do I need SameSite cookie attributes to prevent cross-site request forgery?▼

Yes, SameSite cookie attributes are needed to enforce browser restrictions that block cross-origin requests, serving as a multi-layer defense alongside synchronizer tokens and double-submit cookies.

Does CSRF middleware work for single-page apps and server-rendered forms?▼

Yes, CSRF middleware works for both single-page apps and server-rendered forms by applying synchronizer tokens and double-submit cookies to state-changing endpoints across architectures.

Why does my double-submit cookie CSRF defense fail on cross-origin requests?▼

Double-submit cookie defenses fail when cookie and header values mismatch, causing server-side validation to reject the request. Matching values are required to authorize state-changing actions.

When should I apply token-based defenses to sensitive web endpoints?▼

Apply token-based defenses to logins, transfers, and sensitive state-changing actions. Implementing synchronizer tokens and SameSite cookies protects user data across server-rendered and SPA architectures.

Related Skills

Explore More Software Engineering Skills→
marquesfelipmarquesfelip

csrf-protection

Implement token-based and cookie-based CSRF defenses for state-changing endpoints.

Community
Advanced
harperaaharperaa
15

csrf-protection

Implement HMAC-SHA256 CSRF token protection for POST, PUT, and DELETE API routes.

Community
Intermediate
riftzen-bitriftzen-bit

springboot-security

Identify and remediate security misconfigurations in Java Spring Boot services.

Community
Advanced
abhijeetkakade1234abhijeetkakade1234
1

cors-csrf-audit

Detect CORS misconfigurations and CSRF vulnerabilities in web applications.

Community
Advanced