drupal-security

Enforce secure routing, access checks, and CSRF protections in Drupal applications.

67|13|Updated Apr 15, 2026

Search Tags:#security #xss #validation #sql-injection #drupal #csrf #access-control

Ready to run

npx skills add https://github.com/edutrul/drupal-ai --skill drupal-security-edutrul

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: drupal-security
Source: https://github.com/edutrul/drupal-ai/tree/main/.claude/skills/drupal-security
Command: npx skills add https://github.com/edutrul/drupal-ai --skill drupal-security-edutrul

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Drupal security hardening for routes, controllers, forms, and database queries to prevent common vulnerabilities and misconfigurations.

Core Features & Use Cases

Enforce route permissions and access checks to prevent unauthorized access.
CSRF protection and secure handling of user input across forms and AJAX endpoints.
XSS and SQL injection prevention through proper output escaping and parameterized queries.
Secure file upload validation with extension, MIME-type, and size checks.
Guidance for auditing and securing Drupal code paths in real projects.

Quick Start

Audit a Drupal route or form handler to verify permissions, access checks, and CSRF protection.

Frequently Asked Questions about drupal-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I enforce access control and route permission checks in Drupal modules?▼

Access control in Drupal is enforced by applying route permissions and access checks to prevent unauthorized access. This involves auditing route definitions and controller handlers to verify that proper permission requirements are configured across custom modules.

What's the best way to prevent SQL injection and XSS in Drupal forms and queries?▼

Preventing SQL injection and XSS in Drupal requires using parameterized queries for database access and proper output escaping for rendering. Applying these controls ensures user input is securely handled across forms, controllers, and AJAX endpoints to block common web vulnerabilities.

How do I add CSRF protection to Drupal form submissions and AJAX endpoints?▼

CSRF protection for Drupal form submissions and AJAX endpoints is implemented by securing user input handling and validating tokens. This prevents cross-site request forgery attacks by ensuring that state-changing actions are explicitly authorized by the current user session.

Can I validate Drupal file uploads for extension, MIME-type, and size?▼

Yes, Drupal file upload validation can enforce extension, MIME-type, and size checks. This secure validation process prevents malicious file uploads by verifying that uploaded files match expected types and conform to defined security constraints.

When do I need to audit Drupal routing and controllers for security misconfigurations?▼

Auditing Drupal routing and controllers is needed whenever adding new routes, custom forms, or AJAX endpoints to a module. This process verifies that access checks, CSRF tokens, and input validation are properly applied to prevent unauthorized access and injection vulnerabilities.