# CSRF Protection

Record: `arch:csrf-protection`
Kind: mechanism
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: mandatory for public APIs
Scope: service, web, security
Canonical: https://banes-lab.com/ontology#arch-csrf-protection

## Repair

- Refactored by: Add CSRF Tokens / SameSite Enforcement
- Detected by: no anti-forgery token on mutating endpoints
- Violated by: state-changing requests trusted on cookie presence alone
- Measured by: unprotected state-changing endpoint count
- Enforced by: security review

## requires

- [Request Origin Verification](https://banes-lab.com/records/lex/request-origin-verification.md)

## reinforces

- [Authentication](https://banes-lab.com/records/arch/authentication.md)
- [Defense in Depth](https://banes-lab.com/records/arch/defense-in-depth.md)

## enables

- [Forged-Request Rejection](https://banes-lab.com/records/lex/forged-request-rejection.md)

## conflicts-with

- [Ambient-Credential Trust](https://banes-lab.com/records/lex/ambient-credential-trust.md)

## tensions-with

- [Client Complexity](https://banes-lab.com/records/lex/client-complexity.md)

## tensions

- [CSRF Protection Client Complexity](https://banes-lab.com/records/tension/client-complexity-csrf-protection.md)