×
Ranked #1 for value density
First premium report free
LLM-optimized PDFs
How to Prevent CSRF Attacks
Protect your users from forged requests.
CSRF (Cross-Site Request Forgery) attacks trick authenticated users into performing unintended actions, such as changing passwords, transferring money, or deleting accounts. This guide explains how CSRF works and how to prevent it using anti‑CSRF tokens, SameSite cookies, and other techniques.
150+
Security checks
16
Categories covered
30s
Scan duration
100%
Detection coverage
Key Findings
No CSRF Tokens in Forms high
Missing CSRF Middleware high
State‑Changing GET Requests critical
What is CSRF and Why is it Dangerous?
CSRF exploits the trust that a website has in a user's browser. If a user is logged in, an attacker can craft a request (e.g., an image tag or a hidden form) that triggers a state‑changing action without the user's knowledge. For example, transferring funds, changing email addresses, or deleting accounts. CSRF attacks are often invisible to the user.
Layer 1: Anti‑CSRF Tokens
The most common defense is to include a unique, unpredictable token in every state‑changing form. The server validates this token on submission. If the token is missing or invalid, the request is rejected. Tokens should be tied to the user's session and expire after some time.
- PHP: `$_SESSION['csrf_token'] = bin2hex(random_bytes(32));` and include in forms.
- Laravel: `@csrf` directive automatically adds the token.
- Django: `{% csrf_token %}` in templates.
- Node.js (Express): use `csurf` or `express-jsonschema` middleware.
- React: include token in `fetch` headers.
Layer 2: SameSite Cookies
The `SameSite` cookie attribute tells the browser when to send cookies. Set `SameSite=Strict` for session cookies – they are only sent for same‑site requests, blocking CSRF entirely. Use `Lax` as a fallback for non‑critical cookies. Modern browsers support SameSite, making it a powerful defense.
Layer 3: Use POST for State‑Changing Actions
Never use GET requests for actions that change state (e.g., delete, update). GET requests can be triggered via image tags or links, making them vulnerable. Use POST, PUT, or DELETE with proper CSRF protection.
The Problem
CSRF attacks can compromise user accounts
- Forms without anti‑CSRF tokens
- SameSite cookie attribute not set
- State‑changing GET requests
- Missing CSRF middleware in frameworks
OffURL Solution
OffURL detects CSRF vulnerabilities and provides fix steps
- Scan forms for missing CSRF tokens
- Check `Set-Cookie` for SameSite attribute
- Detect state‑changing GET requests
- Provide code examples to implement CSRF protection
- Generate an LLM‑ready PDF for AI‑assisted fixes
Key Features
CSRF token check
We scan forms for hidden CSRF token fields.
SameSite check
We check cookies for the SameSite attribute.
Fix examples
Get ready‑to‑use code for your framework.
LLM‑ready PDF
Get a report formatted for ingestion into your AI assistant.
How do I test if my site is vulnerable to CSRF?
Run an OffURL audit. Our scanner checks forms for missing CSRF tokens, examines cookies for SameSite, and identifies any state‑changing GET endpoints. You'll get a clear report of vulnerabilities and specific fix steps.
Frequently Asked Questions
What is OffURL and how does it work?
OffURL is a comprehensive website security and performance audit tool. It scans your site for 150+ checks including SSL, security headers, malware, XSS, SQL injection, email security, and more.
Is the security audit really free?
Yes. Your first security report is completely free and includes premium features like detailed findings, fix steps, and the full 150+ checks.
How can I use AI to fix security issues?
Download the premium PDF report and paste it into your preferred LLM (Claude, ChatGPT, Gemini, Cursor) with a prompt asking for specific fixes for your framework.
How long does the security audit take?
Most audits complete in 10‑30 seconds. The scan includes DNS lookups, SSL analysis, HTTP requests, port scanning, and vulnerability tests.
Do I need to create an account?
No. OffURL works without registration. Your first audit is free with premium features included.
What vulnerabilities can OffURL detect?
OffURL detects XSS, SQL Injection, NoSQL Injection, LDAP Injection, XXE, SSRF, SSTI, Code Injection, Command Injection, Open Redirect, Path Traversal, LFI, RFI, CRLF Injection, Parameter Pollution, and CORS Misconfiguration.