# CSRF Protection

> A mechanism that rejects state-changing requests which lack proof of coming from the site's own pages, such as an anti-forgery token.

Record: `architecture:csrf-protection`
Kind: mechanism
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: contextual
Scope: service, web, security
Aliases: Cross-Site Request Forgery Protection
Canonical: https://banes-lab.com/ontology#architecture-csrf-protection

Listed in [Architecture principles](https://banes-lab.com/api/records/architecture.md), after [Continuous Compliance](https://banes-lab.com/records/architecture/continuous-compliance.md) and before [Parameterized Queries](https://banes-lab.com/records/architecture/parameterized-queries.md).

## Repair

- Refactored by: Add CSRF Tokens / SameSite Enforcement
- Detected by: no anti-forgery token on mutating endpoints
- Violated by: state-changing requests trusted on cookie presence alone
- Measured by: unprotected state-changing endpoint count
- Enforced by: security review

## Requires

- [Request Origin Verification](https://banes-lab.com/records/lexicon/request-origin-verification.md)

## Reinforces

- [Authentication](https://banes-lab.com/records/architecture/authentication.md)
- [Defense in Depth](https://banes-lab.com/records/architecture/defense-in-depth.md)

## Enables

- [Forged-Request Rejection](https://banes-lab.com/records/lexicon/forged-request-rejection.md)

## Conflicts with

- [Ambient-Credential Trust](https://banes-lab.com/records/lexicon/ambient-credential-trust.md)

## In tension with

- [Client Complexity](https://banes-lab.com/records/lexicon/client-complexity.md)

## Tensions

- [CSRF Protection / Client Complexity](https://banes-lab.com/records/tension/client-complexity-csrf-protection.md)

## Severity

- [contextual](https://banes-lab.com/records/vocabulary/severity-contextual.md)

## Category

- [Security / Privacy / Compliance / Governance](https://banes-lab.com/records/architecture-category/security-privacy-compliance-governance.md)

## Linked from

- [Security / Privacy / Compliance / Governance](https://banes-lab.com/ontology/principles/architecture-category-security-privacy-compliance-governance.md)
- [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lexicon-category-security-privacy-compliance.md)
- [Severity levels](https://banes-lab.com/ontology/schema/the-vocabulary-severity.md)
- [The resolutions](https://banes-lab.com/ontology/schema/the-resolutions.md)