CSRF Protection

Kind: mechanism

Layer: Security Core

Aliases: Cross-Site Request Forgery Protection

Record: architecture:csrf-protection

Severity: contextual

Scope: service, web, security

Canonical: Ontology

A mechanism that rejects state-changing requests which lack proof of coming from the site's own pages, such as an anti-forgery token.

Listed in Architecture principles, after Continuous Compliance and before Parameterized Queries.

Requires

• Request Origin Verification

Reinforces

• Authentication
• Defense in Depth

Enables

• Forged-Request Rejection

Conflicts with

• Ambient-Credential Trust

In tension with

• Client Complexity

Tensions

• CSRF Protection / Client Complexity

Violated by

• Ambient-Credential Trust

Severity

• contextual

Category

• Security / Privacy / Compliance / Governance

Linked from

• Security / Privacy / Compliance / Governance
• Security Privacy Compliance
• Severity levels
• The resolutions