Security Test: POST based CSRF¶

Description¶

Default Severity: medium

POST based CSRF is when an attacker tricks a user's browser into sending a POST request that seems legitimate to a server because the browser automatically includes authentication details like cookies. The danger lies in the fact that the attacker can make the server perform harmful actions, such as altering data or initiating unintended transactions, without the user's clear intent. This often happens when developers allow too much flexibility in what type of content the server accepts, like not enforcing a strict JSON format. Developers need to be wary of these lax validations, as they provide an opening for attackers to misuse a user's credentials and cause potential data breaches or financial losses.

Reference:

• https://blog.doyensec.com/2021/05/20/graphql-csrf.html

Configuration¶

Identifier: frontend_request_forgery/csrf_post_based

Examples¶

All configuration available:

checks:
  frontend_request_forgery/csrf_post_based:
    skip: false # default

Compliance and Standards¶