概要
Cross-Site Request Forgery rode high in the OWASP Top 10 for years and then quietly fell off as `SameSite=Lax` became the browser default. The bug isn't dead — it lives on in apps that use `SameSite=None` for cross-domain reasons (embedded widgets, third-party SSO contexts), in legacy session frameworks, in JSON APIs that mistakenly rely on Content-Type to gatekeep, and anywhere a developer thought 'we have auth, that's enough.' The blast radius is full impersonation: every action your app can perform through a logged-in user becomes performable from any other website that user happens to visit while logged in.
仕組み
CSRF appears when state-changing actions rely only on ambient browser credentials. A malicious site can then attempt to make the victim's browser submit actions they did not intend.
被害範囲
Forced state changes performed as the victim — money transfer, password change, email-on-file change (precondition for account takeover), account deletion, content posting under their name. In OAuth / SSO contexts, login CSRF lets the attacker bind your account to an identity they control. For SaaS apps, CSRF can trigger billing changes, plan upgrades, or data exports without the user's knowledge.
// what fixvibe checks
What FixVibe checks
FixVibe checks this class with verified-domain active testing that is bounded, non-destructive, and evidence-driven. Public reports describe the affected surface and remediation. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
鉄壁の防御
Set `SameSite=Lax` (or `Strict` for high-value cookies) on every session cookie. Lax defeats the classic form-based CSRF for most cases without breaking normal navigation. For JSON APIs, require a custom header like `X-Requested-With: XMLHttpRequest` or a `X-CSRF-Token` — browsers won't send custom headers on cross-origin form submissions, so this is a strong gate. Use the synchronizer-token pattern for traditional server-rendered forms: include a per-session, per-form random token in the form HTML and verify it on submit. Modern frameworks (Django, Rails, Laravel, ASP.NET, Express with csurf) ship CSRF middleware; turn it on. Never mutate state on GET — turn account-delete-via-link patterns into POST with CSRF protection. Use `__Host-` cookie name prefix (`__Host-session`) to bind the cookie to your origin and forbid attribute downgrades. Audit your endpoints: if a request to a state-changing route succeeds without any of these defenses present, you have a finding.