Request Forgery: CSRF Token Invalidation¶

Identifier: csrf_token_invalidation

Scanner(s) Support¶

Description¶

CSRF tokens should be invalidated or rotated when the protected session or workflow state changes so stale tokens cannot be reused indefinitely.

How we test: We replay previously issued CSRF tokens after logout, token rotation, workflow completion, or other invalidation events and verify whether state-changing requests still accept the stale token.

References:

• https://portswigger.net/web-security/csrf
• https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html

Configuration¶

Example¶

Example configuration:

---
security_tests:
  csrf_token_invalidation:
    skip: false

Reference¶

skip¶

Type : boolean

Skip the test if true.