Csrf Protection

secondsky/claude-skills/plugins/csrf-protection/skills/csrf-protection

作者 secondsky88378361314fMIT227 个星标收录于 2026年10月8日更新于 2026年10月8日仓库10天前更新

Implements CSRF protection using synchronizer tokens, double-submit cookies, and SameSite attributes. Use when securing web forms, protecting state-changing endpoints, or implementing defense-in-depth authentication.

仅含说明Security Software Development

AI 生成的概览

指导使用同步令牌、双重提交 Cookie 和 SameSite 属性实现 CSRF 防护。

功能: 该技能提供防御跨站请求伪造的说明和代码示例。内容涵盖 Express 中同步令牌的生成与校验、SameSite Cookie 配置、HTML 表单集成，以及令牌过期和 Origin/Referer 校验等最佳实践。它还指向一个参考文件，其中包含 Flask-WTF 配置、React 令牌管理钩子和双重提交 Cookie 模式。
适用场景: 适用于保护 Web 表单、防护会改变状态的端点，或为认证流程增加纵深防御。目标读者是需要在 Web 应用中实现 CSRF 防护的开发者。
运行要求: 不附带脚本，仅为说明文档。示例假定使用 JavaScript/Express 环境并配合会话中间件和 Node 的 crypto 模块，参考文件涉及 Python/Flask 与 React。

CSRF Protection

Defend against Cross-Site Request Forgery attacks using multiple protection layers.

Protection Methods

Token-Based Protection (Express)

javascript

const crypto = require('crypto');
function generateToken() {  return crypto.randomBytes(32).toString('hex');}
// Middlewareapp.use((req, res, next) => {  if (!req.session.csrfToken) {    req.session.csrfToken = generateToken();  }  res.locals.csrfToken = req.session.csrfToken;  next();});
// Validationapp.post('*', (req, res, next) => {  const token = req.body._csrf || req.headers['x-csrf-token'];  // crypto.timingSafeEqual throws RangeError when buffers differ in length,  // so check length explicitly first (still constant-time on the equal-length path).  const csrf = req.session.csrfToken || '';  if (!token || token.length !== csrf.length) {    return res.status(403).json({ error: 'Invalid CSRF token' });  }  if (!crypto.timingSafeEqual(Buffer.from(token), Buffer.from(csrf))) {    return res.status(403).json({ error: 'Invalid CSRF token' });  }  next();});

const crypto = require('crypto');
function generateToken() {  return crypto.randomBytes(32).toString('hex');}
// Middlewareapp.use((req, res, next) => {  if (!req.session.csrfToken) {    req.session.csrfToken = generateToken();  }  res.locals.csrfToken = req.session.csrfToken;  next();});
// Validationapp.post('*', (req, res, next) => {  const token = req.body._csrf || req.headers['x-csrf-token'];  // crypto.timingSafeEqual throws RangeError when buffers differ in length,  // so check length explicitly first (still constant-time on the equal-length path).  const csrf = req.session.csrfToken || '';  if (!token || token.length !== csrf.length) {    return res.status(403).json({ error: 'Invalid CSRF token' });  }  if (!crypto.timingSafeEqual(Buffer.from(token), Buffer.from(csrf))) {    return res.status(403).json({ error: 'Invalid CSRF token' });  }  next();});

SameSite Cookies

javascript

app.use(session({  cookie: {    httpOnly: true,    secure: true,    sameSite: 'strict', // or 'lax'    maxAge: 3600000  }}));

app.use(session({  cookie: {    httpOnly: true,    secure: true,    sameSite: 'strict', // or 'lax'    maxAge: 3600000  }}));

HTML Form Integration

html

<form method="POST" action="/transfer">  <input type="hidden" name="_csrf" value="<%= csrfToken %>">  <button type="submit">Submit</button></form>

<form method="POST" action="/transfer">  <input type="hidden" name="_csrf" value="<%= csrfToken %>">  <button type="submit">Submit</button></form>

Best Practices

Apply to all state-changing requests (POST, PUT, DELETE)
Use SameSite=Strict for sensitive cookies
Validate Origin/Referer headers
Never use GET for modifications
Implement token expiration (1 hour typical)
Combine multiple defense layers

Additional Implementations

See references/python-react.md [blocked] for:

Flask-WTF complete CSRF setup
React hooks for CSRF token management
Double submit cookie pattern

Common Mistakes

Assuming authentication prevents CSRF
Reusing tokens across sessions
Storing tokens in localStorage
Missing token expiration

来源与署名

来源：secondsky/claude-skills位于plugins/csrf-protection/skills/csrf-protection提交8837836

许可证： MIT

内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。

举报或申请下架

Method	How It Works	Browser Support
Synchronizer Token	Hidden form field validated server-side	All
Double Submit	Cookie + header must match	All
SameSite Cookie	Browser blocks cross-origin requests	Modern

Csrf Protection

CSRF Protection

Protection Methods

Token-Based Protection (Express)

SameSite Cookies

HTML Form Integration

Best Practices

Additional Implementations

Common Mistakes

来源与署名

更多来自 secondsky/claude-skills 的技能

Vulnerability Scanning

Web Performance Optimization

Web Performance Audit

Threejs

Tailwind V4 Shadcn

Technical Specification

更多Security技能

Kyc Rules

Compliance Tracking

Dpop Adoption

Secops Triage

Secops Investigate

Secops Hunt