security-review-owasp-cross-site-request-forgery-prevention

To review code for CSRF vulnerabilities, inspect token generation, session binding, and validation coverage across form posts and AJAX requests. Evaluate SameSite cookies, Origin and Referer checks, and Fetch Metadata enforcement to confirm whether state-changing endpoints require trustworthy request-origin proof.

Checking SameSite cookies and Origin validation involves evaluating browser-signal enforcement on sensitive endpoints. Review SameSite policy attributes, verify Origin and Referer headers against trusted domains, and test Fetch Metadata headers to ensure untrusted cross-site requests are blocked before state changes occur.

CSRF token validation for AJAX requests and APIs works by requiring synchronizer tokens or custom headers for state-changing operations. Review CORS exposure, client-side request construction, and double-submit cookie patterns to ensure attackers cannot forge authenticated API calls from external domains.

You can use Fetch Metadata headers to protect login flows by enforcing strict Sec-Fetch-Site, Sec-Fetch-Mode, and Sec-Fetch-Dest values. Combine Fetch Metadata enforcement with Origin checks and SameSite cookies to prevent cross-site requests from bypassing CSRF protections on authentication endpoints.

Review CORS settings for CSRF weaknesses whenever APIs or AJAX endpoints accept authenticated state-changing requests. Check whether permissive Access-Control-Allow-Origin headers expose sensitive endpoints to cross-origin requests, and verify that custom header requirements and Origin validation prevent unauthorized cross-site access.

CSRF token validation may fail for webhook receivers when endpoints lack Origin or Referer verification and accept unauthenticated state changes. Review whether synchronizer tokens or double-submit cookies apply to webhook flows, and enforce Fetch Metadata or trusted-IP restrictions to prevent forged cross-site requests.