Csrf Protection

Implements the three main CSRF protection patterns: synchronizer tokens, double-submit cookies, and SameSite attributes. You get Express middleware with proper timing-safe comparison, session token generation, and form integration examples. The guide walks through when to apply each method and shows the HTML side too. Covers Flask and React implementations in the references. Honestly, the best part is it doesn't just dump code at you. It explains why you need multiple layers and calls out the common mistakes like thinking auth alone protects you or storing tokens in localStorage. Solid reference when you're hardening state-changing endpoints.

skills.sh installs: 474
GitHub stars: 248
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add secondsky/claude-skills --skill csrf-protection --agent claude-code

Installs into .claude/skills of the current project.

Files

CSRF Protection

Defend against Cross-Site Request Forgery attacks using multiple protection layers.

Protection Methods

Method	How It Works	Browser Support
Synchronizer Token	Hidden form field validated server-side	All
Double Submit	Cookie + header must match	All
SameSite Cookie	Browser blocks cross-origin requests	Modern

Token-Based Protection (Express)

const crypto = require('crypto');

function generateToken() {
  return crypto.randomBytes(32).toString('hex');
}

// Middleware
app.use((req, res, next) => {
  if (!req.session.csrfToken) {
    req.session.csrfToken = generateToken();
  }
  res.locals.csrfToken = req.session.csrfToken;
  next();
});

SKILL.md on GitHub

Sponsors

Promote your product hereReach 125k+ visitors monthly Promote your product hereReach 125k+ visitors monthly