CSRF protection
We implement CSRF (Cross-Site Request Forgery) protection: anti-CSRF tokens on forms and state-changing actions, SameSite-cookie checks and request-origin verification. So an attacker cannot perform an action on behalf of a logged-in user via a forged request. Honestly upfront: this closes a specific class of attacks (CSRF), not 'all of security' — it works in combination with session and XSS protection.
CSRF protection — overview
CSRF protection is a project: we implement anti-CSRF tokens (synchronizer/double-submit) on all state-changing operations (forms, POST/PUT/DELETE, important GET actions), set up the SameSite cookie attribute, Origin/Referer checks where appropriate, correct handling for API and SPA. Honestly about the scope, this is key: CSRF protection closes a SPECIFIC class of attacks — performing an action on behalf of an authenticated user via a request from another site; an important and mandatory measure, but it does NOT protect against other classes (XSS, injections, session hijacking) — it is part of defense-in-depth, not all of security. Important: with an active XSS vulnerability a CSRF token can be stolen/bypassed — so CSRF and XSS protection go together. Honestly about implementation: protection is effective only with FULL and correct coverage of all state-changing actions — missing one form leaves a hole; we do it systematically and test. Honestly about SPA/API: for token authentication (not cookies) CSRF risks differ — we account for the specifics. Honestly about access: access to the code is needed. Honestly about the effect: it closes the CSRF attack class, we do NOT guarantee sales growth by itself (this is security, not marketing). An important boundary: this is anti-CSRF, not XSS protection (752 — adjacent, mandatory together) and not session management (750). If the site has no authenticated state-changing actions, CSRF risk is minimal. Picture this: instead of 'a fake site initiates an action on behalf of your logged-in user' — requests without a valid token are rejected. The base price starts from 12,000 ₽ per project; it depends on the number of forms/actions.
Problems we solve
- State-changing actions are not protected by an anti-CSRF token.
- A request can be forged on behalf of a logged-in user.
- SameSite cookies and origin verification are not set up.
- Coverage is partial — some forms are unprotected.
What's included in the CSRF protection service
- Implementing anti-CSRF tokens on state-changing actions
- Setting up the SameSite cookie attribute
- Origin/Referer verification where appropriate
- Correct handling for API/SPA
- Full coverage of all state-changing operations
- Testing (no bypasses/missed forms)
- Indicating boundaries (combo with anti-XSS needed)
- Handover and review with you
What you get
- Forgery of requests on behalf of a user is blocked
- Full token coverage of state-changing actions
- Correct SameSite cookies and checks
- The CSRF attack class is closed (all security — in combination)
How the work goes: steps
- We audit state-changing actions and cookies; collect code access
- We implement tokens, SameSite, checks, cover everything
- We test for bypasses, review with you
Why PDV Expert
- Fixed price and timeline — no surprises on the invoice.
- Report and recommendations in plain language — clear without a technical background.
- In touch at every step and answering questions about the result.
FAQ
Will CSRF protection close all vulnerabilities?
No. It closes a specific class of attacks (forging a request on behalf of a user), but does not protect against XSS, injections, session hijacking — it is part of overall protection. Moreover, with active XSS a CSRF token can be bypassed, so CSRF and XSS protection go together.
Is it enough to protect one or two forms?
No. Protection is effective only with full coverage of ALL state-changing actions — missing one form leaves a hole. We do it systematically across the site and test so there are no unhandled points.
What about API/SPA?
For token authentication (not cookies) CSRF risks differ from classic cookie sessions. We account for your architecture's specifics and set up protection correctly for it.
About the provider
The «CSRF protection» service is provided by PDV Expert — a team specialising in «Site quality». We work under contract and deliver a written report with recommendations.