Csrf Protection

作者 secondsky88378361314fMIT227 個星標收錄於 2026年10月8日更新於 2026年10月8日儲存庫10 天前更新

Implements CSRF protection using synchronizer tokens, double-submit cookies, and SameSite attributes. Use when securing web forms, protecting state-changing endpoints, or implementing defense-in-depth authentication.

僅含說明Security Software Development

AI 產生的概覽

指導使用同步權杖、雙重提交 Cookie 與 SameSite 屬性實作 CSRF 防護。

功能: 此技能提供防禦跨站請求偽造的說明與程式碼範例。內容涵蓋 Express 中同步權杖的產生與驗證、SameSite Cookie 設定、HTML 表單整合，以及權杖到期與 Origin/Referer 驗證等最佳實務。它也指向一份參考檔案，內含 Flask-WTF 設定、React 權杖管理 Hook 與雙重提交 Cookie 模式。
適用情境: 適用於保護網頁表單、防護會改變狀態的端點，或為驗證流程增加縱深防禦。目標對象是需要在網頁應用程式中實作 CSRF 防護的開發者。
執行需求: 不隨附指令碼，僅為說明文件。範例假定使用 JavaScript/Express 環境並搭配工作階段中介軟體與 Node 的 crypto 模組，參考檔案則涉及 Python/Flask 與 React。

CSRF Protection

Defend against Cross-Site Request Forgery attacks using multiple protection layers.

Protection Methods

Token-Based Protection (Express)

javascript

const crypto = require('crypto');
function generateToken() {  return crypto.randomBytes(32).toString('hex');}
// Middlewareapp.use((req, res, next) => {  if (!req.session.csrfToken) {    req.session.csrfToken = generateToken();  }  res.locals.csrfToken = req.session.csrfToken;  next();});
// Validationapp.post('*', (req, res, next) => {  const token = req.body._csrf || req.headers['x-csrf-token'];  // crypto.timingSafeEqual throws RangeError when buffers differ in length,  // so check length explicitly first (still constant-time on the equal-length path).  const csrf = req.session.csrfToken || '';  if (!token || token.length !== csrf.length) {    return res.status(403).json({ error: 'Invalid CSRF token' });  }  if (!crypto.timingSafeEqual(Buffer.from(token), Buffer.from(csrf))) {    return res.status(403).json({ error: 'Invalid CSRF token' });  }  next();});

const crypto = require('crypto');
function generateToken() {  return crypto.randomBytes(32).toString('hex');}
// Middlewareapp.use((req, res, next) => {  if (!req.session.csrfToken) {    req.session.csrfToken = generateToken();  }  res.locals.csrfToken = req.session.csrfToken;  next();});
// Validationapp.post('*', (req, res, next) => {  const token = req.body._csrf || req.headers['x-csrf-token'];  // crypto.timingSafeEqual throws RangeError when buffers differ in length,  // so check length explicitly first (still constant-time on the equal-length path).  const csrf = req.session.csrfToken || '';  if (!token || token.length !== csrf.length) {    return res.status(403).json({ error: 'Invalid CSRF token' });  }  if (!crypto.timingSafeEqual(Buffer.from(token), Buffer.from(csrf))) {    return res.status(403).json({ error: 'Invalid CSRF token' });  }  next();});

SameSite Cookies

javascript

app.use(session({  cookie: {    httpOnly: true,    secure: true,    sameSite: 'strict', // or 'lax'    maxAge: 3600000  }}));

app.use(session({  cookie: {    httpOnly: true,    secure: true,    sameSite: 'strict', // or 'lax'    maxAge: 3600000  }}));

HTML Form Integration

html

<form method="POST" action="/transfer">  <input type="hidden" name="_csrf" value="<%= csrfToken %>">  <button type="submit">Submit</button></form>

<form method="POST" action="/transfer">  <input type="hidden" name="_csrf" value="<%= csrfToken %>">  <button type="submit">Submit</button></form>

Best Practices

Apply to all state-changing requests (POST, PUT, DELETE)
Use SameSite=Strict for sensitive cookies
Validate Origin/Referer headers
Never use GET for modifications
Implement token expiration (1 hour typical)
Combine multiple defense layers

Additional Implementations

See references/python-react.md [blocked] for:

Flask-WTF complete CSRF setup
React hooks for CSRF token management
Double submit cookie pattern

Common Mistakes

Assuming authentication prevents CSRF
Reusing tokens across sessions
Storing tokens in localStorage
Missing token expiration

來源與署名

來源：secondsky/claude-skills位於plugins/csrf-protection/skills/csrf-protection提交8837836

授權條款： MIT

內容歸原作者所有。SourceWeft 從公開儲存庫中收錄這些內容。

檢舉或申請下架

Method	How It Works	Browser Support
Synchronizer Token	Hidden form field validated server-side	All
Double Submit	Cookie + header must match	All
SameSite Cookie	Browser blocks cross-origin requests	Modern

Csrf Protection

CSRF Protection

Protection Methods

Token-Based Protection (Express)

SameSite Cookies

HTML Form Integration

Best Practices

Additional Implementations

Common Mistakes

來源與署名

更多來自 secondsky/claude-skills 的技能

Vulnerability Scanning

Web Performance Optimization

Web Performance Audit

Threejs

Tailwind V4 Shadcn

Technical Specification

更多Security技能

Compliance Tracking

Dpop Adoption

Secops Triage

Secops Investigate

Secops Hunt

Secops Cases