Add CSRF protection to a form

csrf-no-protection

A state-changing form with no CSRF token can be submitted from any other site using the visitor's own cookies. Add a token and check it server side.

Your stack

Next.js

1 For Server Actions, Next.js handles CSRF automatically
2 For API routes, use SameSite cookies and validate the Origin header

typescript

// API route CSRF check
export async function POST(request) {
  const origin = request.headers.get('origin');
  if (origin !== process.env.NEXT_PUBLIC_URL) {
    return new Response('Forbidden', { status: 403 });
  }
  // ...
}

Express

1 Add CSRF protection middleware (csurf or custom token validation)

javascript

// Using csrf-csrf package (csurf is deprecated)
const { doubleCsrf } = require("csrf-csrf");
const { doubleCsrfProtection } = doubleCsrf({
  getSecret: () => process.env.CSRF_SECRET,
  cookieName: "__csrf",
  cookieOptions: { sameSite: "lax", secure: true },
});
app.use(doubleCsrfProtection);

Django

1 Django includes CSRF protection by default
2 Ensure CsrfViewMiddleware is in MIDDLEWARE and templates use {% csrf_token %}

python

# settings.py - ensure this is present
MIDDLEWARE = [
    'django.middleware.csrf.CsrfViewMiddleware',
    # ...
]

# In templates:
# <form method="post">{% csrf_token %} ...</form>

Laravel

1 Laravel includes CSRF protection by default via VerifyCsrfToken middleware
2 Ensure your forms include @csrf

html

{{-- Blade template --}}
<form method="POST" action="/submit">
    @csrf
    ...
</form>

Rails

1 Rails includes CSRF protection by default
2 Ensure protect_from_forgery is in ApplicationController

ruby

# app/controllers/application_controller.rb
class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Spring Boot

1 Spring Security enables CSRF protection by default
2 Ensure it's not disabled in your SecurityFilterChain

java

@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    // Don't do this:
    // http.csrf(csrf -> csrf.disable());
    // CSRF is enabled by default - leave it on
    return http.build();
}

ASP.NET

1 Use the [ValidateAntiForgeryToken] attribute on POST actions
2 Include @Html.AntiForgeryToken() in forms

csharp

// Controller
[HttpPost]
[ValidateAntiForgeryToken]
public IActionResult Submit(FormModel model)
{
    // ...
}

// View: <form asp-antiforgery="true">

Does your app still have this?

Scan your domain