csrf-protection

SKILL.md

Imagine you're logged into your banking app. In another tab, you visit a malicious website. That website contains hidden code that submits a form to your bank: "Transfer $10,000 to attacker's account." Because you're logged in, your browser automatically sends your session cookie, and the bank processes the transfer.

This is Cross-Site Request Forgery—tricking your browser into making requests you didn't intend.

Router DNS Hijacking (2008): A CSRF vulnerability in several home routers allowed attackers to change router DNS settings by tricking users into visiting a malicious website. Victims lost no money but were redirected to phishing sites for months. Millions of routers were affected.

Implement Cross-Site Request Forgery (CSRF) protection for API routes.当您需要保护 POST/PUT/DELETE 端点、实施令牌验证、防止跨站点攻击或安全表单提交时，请使用此技能。 Triggers include "CSRF", "cross-site request forgery", "protect form", "token validation", "withCsrf", "CSRF token", "session fixation". 来源：harperaa/secure-claude-skills。

查看原文