Security Test: POST based CSRF¶

Description¶

Default Severity: medium

POST based CSRF happens when an attacker tricks a user's browser into making a POST request that the server thinks is legitimate because the browser automatically sends authentication data like cookies. Essentially, the attack exploits when your server accepts requests in a flexible way—especially if it accepts different content types like form submissions—instead of strictly enforcing something like a JSON payload. This can lead to dangerous actions like altering data or making unintended financial transactions, because the user's credentials are automatically submitted without their explicit intention. Developers often mistakenly relax validations on the type of content their endpoints accept, making it easier for attackers to use the browser’s credentials to their advantage.

Reference:

• https://blog.doyensec.com/2021/05/20/graphql-csrf.html

Configuration¶

Identifier: request_forgery/csrf_post_based

Examples¶

All configuration available:

checks:
  request_forgery/csrf_post_based:
    skip: false # default

Compliance and Standards¶