Cross-Site Request Forgery (CSRF)

High Severity Technical Guide

Vulnerability Description

CSRF is an attack that forces an authenticated user to execute unwanted actions on a web application in which they are currently logged in, typically using malicious links or third-party sites.

Remediation Guide

To resolve this vulnerability, follow these config changes or developer practices:

Enforce anti-CSRF tokens for all state-changing requests (POST, PUT, DELETE). Use the SameSite=Lax or SameSite=Strict attribute on session cookies to prevent cross-site transit.

Verify Your Fix

After applying the remediation, run an external attack-surface scan to verify that the vulnerability is no longer detected by WebScanify.

Is your website vulnerable?

Run a free security scan now to identify missing headers, outdated JS, and other deployment vulnerabilities.