Stats
Actions
Tags
From soundcheck
Detects missing CSRF protection in forms, state-changing endpoints, and session cookie config. Use when writing HTML forms, setting CSRF middleware, or disabling framework protections.
How this skill is triggered — by the user, by Claude, or both
Slash command
/soundcheck:csrfThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Protects against cross-site request forgery, where an attacker tricks an authenticated
Protects against cross-site request forgery, where an attacker tricks an authenticated user's browser into submitting a state-changing request the user did not intend. Exploitation leads to unauthorized fund transfers, account takeover, or privilege escalation.
SameSite attribute (Lax or Strict)Flag the vulnerable code and explain the risk. Then suggest a fix that establishes these properties:
Authorization: Bearer headers, not cookies), the opt-out must be explicit
and the cookie-auth path must remain protected.SameSite=Lax at minimum, or SameSite=Strict for
sensitive flows, plus Secure and HttpOnly. This blocks cross-origin
cookie attachment on top-level navigations or subrequests that don't need it.Referer headers — they live
in a hidden form field or a dedicated request header, never in the query string.Translate these principles to the audited file's language and framework. Use the documented CSRF middleware and template helpers for that stack — do not hand-build token comparison logic.
Confirm the following properties hold (language-agnostic):
SameSite=Lax or SameSite=Strict attributenpx claudepluginhub thejefflarson/soundcheck --plugin soundcheckValidates CSRF protections in web apps: inventories state-changing endpoints, audits synchronizer tokens, double-submit cookies, SameSite, Origin/Referer headers for gaps.
Protects state-changing endpoints (POST, PUT, PATCH, DELETE) from cross-site request forgery using synchronizer tokens, SameSite cookies, or origin verification.
Prevents CSRF attacks by validating request origin and using unpredictable tokens for state-changing operations. Covers SameSite cookies, sync token pattern, double-submit cookie pattern, and origin header validation.