Agent skill · software engineering · aj-geddes
csrf-protection
Implement Cross-Site Request Forgery (CSRF) protection using tokens, SameSite cookies, and origin validation. Use when building forms and state-changing operations.
Why this skill is useful
Provides specific implementation patterns and best practices for CSRF protection in various frameworks that the AI wouldn't reliably generate on its own.
What it needs
Requires crypto, csurf installed locally. About 1k tokens when loaded. Last updated 2026-03-04. 307 stars on the source repository.
What this skill does
CSRF Protection Table of Contents Overview When to Use Quick Start Reference Guides Best Practices Overview Implement comprehensive Cross-Site Request Forgery protection using synchronizer tokens, double-submit cookies, SameSite cookie attributes, and custom headers. When to Use Form submissions State-changing operations Authentication systems Payment processing Account management Any POST/PUT/DELETE requests Quick Start Minimal working example: Reference Guides Detailed implementations in the references/ directory: Guide Contents --- --- Node.js/Express CSRF Protection Node.js/Express CSRF Protection Double Submit Cookie Pattern Double Submit Cookie Pattern Python Flask CSRF Protection Python Flask CSRF Protection Frontend CSRF Implementation Frontend CSRF Implementation Origin and Referer Validation Origin and Referer Validation Best Practices ✅ DO Use CSRF tokens for all state-changing operations Set SameSite=Strict on cookies Validate Origin/Referer headers Use secure, random tokens Implement token expiration Use HTTPS only Include tokens in AJAX requests Test CSRF protection ❌ DON'T Skip CSRF for authenticated requests Use GET for state changes Trust Origin header alone Reuse tokens Store tokens in localStorage Allow credentials in CORS without validation
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aj-geddes/csrf-protection