Csrf Protection

Solid foundation for implementing CSRF protection across your web apps. Covers the main approaches: synchronizer tokens, double-submit cookies, SameSite attributes, and origin validation. The reference guides walk through implementations in Node.js/Express and Python Flask, plus frontend integration patterns. Worth noting it emphasizes the basics well, like never using GET for state changes and always pairing tokens with HTTPS. If you're building forms, payment flows, or anything that modifies server state, this gives you the patterns to prevent forged requests. The best practices section is actually useful, calling out common mistakes like storing tokens in localStorage.

skills.sh installs: 477
GitHub stars: 379
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add aj-geddes/useful-ai-prompts --skill csrf-protection --agent claude-code

Installs into .claude/skills of the current project.

Files

Overview

Implement comprehensive Cross-Site Request Forgery protection using synchronizer tokens, double-submit cookies, SameSite cookie attributes, and custom headers.

When to Use

Form submissions
State-changing operations
Authentication systems
Payment processing
Account management
Any POST/PUT/DELETE requests

Quick Start

Minimal working example:

// csrf-protection.js
const crypto = require("crypto");
const csrf = require("csurf");

class CSRFProtection {
  constructor() {
    this.tokens = new Map();
    this.tokenExpiry = 3600000; // 1 hour
  }

  /**
   * Generate CSRF token
   */
  generateToken() {
    return crypto.randomBytes(32).toString("hex");
  }

  /**
   * Create token for session
   */
  createToken(sessionId) {
    const token = this.generateToken();
    const expiry = Date.now() + this.tokenExpiry;

    this.tokens.set(sessionId, {
// ... (see reference guides for full implementation)