CSRF Protection

About

This skill provides a robust architecture for preventing Cross-Site Request Forgery attacks, a common vulnerability where malicious websites trick browsers into performing unintended actions. It offers comprehensive implementation guidance for generating HMAC-SHA256 signed, single-use, session-bound tokens. By integrating these patterns into API routes and frontend forms, developers can ensure that state-changing operations like POST, PUT, and DELETE are authenticated and originate from trusted sources while following industry-standard security protocols.

Key Features

• 1 GitHub stars
• HMAC-SHA256 cryptographic token signing for tamper-proof validation
• Single-use and session-bound token patterns to minimize attack windows
• Secure cookie configuration including HttpOnly and SameSite=Strict settings
• Middleware implementation for automatic token verification in API routes
• Guidance on avoiding common anti-patterns like token reuse or URL-based tokens

Use Cases

• Protecting sensitive API endpoints like account deletion or financial transfers
• Securing public-facing forms from automated cross-site submission attacks
• Hardening web application security posture against session-based exploits