CSRF Protection Scanner

Check if your forms and API endpoints are protected against cross-site request forgery.

How this scan works

Parse same-origin <form method=post> for a hidden CSRF token field
Check the cookie SameSite attribute as a mitigating control (Lax/Strict vs None)
Check for Origin/Referer validation hints — does the state-changing route reject a mismatched Origin
Flag JSON-only APIs (harder to CSRF by default) vs. classic form posts