Agent skill · software engineering · secondsky
csrf-protection
Implements CSRF protection using synchronizer tokens, double-submit cookies, and SameSite attributes. Use when securing web forms, protecting state-changing endpoints, or implementing defense-in-depth authentication.
Why this skill is useful
Adds specific implementation patterns and middleware for CSRF protection that the AI wouldn't reliably generate on its own.
What it needs
About 1k tokens when loaded. Last updated 2026-08-06. 204 stars on the source repository.
What this skill does
CSRF Protection Defend against Cross-Site Request Forgery attacks using multiple protection layers. Protection Methods Method How It Works Browser Support -------- -------------- ----------------- Synchronizer Token Hidden form field validated server-side All Double Submit Cookie + header must match All SameSite Cookie Browser blocks cross-origin requests Modern Token-Based Protection (Express) SameSite Cookies HTML Form Integration Best Practices Apply to all state-changing requests (POST, PUT, DELETE) Use SameSite=Strict for sensitive cookies Validate Origin/Referer headers Never use GET for modifications Implement token expiration (1 hour typical) Combine multiple defense layers Additional Implementations See references/python-react.md for: Flask-WTF complete CSRF setup React hooks for CSRF token management Double submit cookie pattern Common Mistakes Assuming authentication prevents CSRF Reusing tokens across sessions Storing tokens in localStorage Missing token expiration
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills secondsky/csrf-protection