OWASP CSRF Prevention Cheat Sheet

1. Token-Based Mitigation

   Anti-CSRF tokens and where to transmit them.

2. Synchronizer Token Pattern

   Server-side per-session or per-request token validation.

3. Double Submit Cookie

   Signed double-submit cookies for stateless apps.

4. Fetch Metadata Headers

   Sec-Fetch-Site and related headers for resource isolation.

5. Disallowing Simple Requests

   Custom request headers and content-type restrictions for AJAX and APIs.

6. Client-Side CSRF

   Client-side CSRF mitigation techniques.

7. Defense in Depth

   SameSite attribute, Origin verification and user interaction defenses.

8. Login CSRF

   CSRF in login forms and session fixation.

9. JavaScript Token Inclusion

   Automatically attaching CSRF tokens to AJAX requests.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.

• OWASP API Security Top 10 (2023)
• OWASP ASVS
• OWASP Authentication Cheat Sheets
• OWASP Authorization Cheat Sheets
• OWASP CI/CD and Supply Chain Cheat Sheets
• OWASP Cryptographic Storage Cheat Sheets
• OWASP Dependency-Check
• OWASP Deserialization Cheat Sheet
• OWASP Django Security Cheat Sheets
• OWASP Docker Security Cheat Sheet
• OWASP File Upload Cheat Sheet
• OWASP GraphQL Cheat Sheet