# Cross-Site Request Forgery (CSRF) (CWE-352)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

**Stack:** JavaScript

- Prevalence: 中 覆盖 3 种语言
- Impact: 高 3 条严重级别为高的规则
- Prevention: 已记录 3 个修复示例

**OWASP:** Broken Access Control (A01:2021-Broken Access Control) - #1

## Description

When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request.

## Prevention

基于 1 条 Shoulder 检测规则的 Cross-Site Request Forgery 预防策略。

### JavaScript

Create HTTP interceptors to centralize authentication tokens and CSRF protection across all requests

## Warning Signs

- [HIGH] HttpClient used without security interceptors. Missing centralized authentication, CSRF protection, and security headers

## Consequences

- 修改应用程序数据
- 获取权限
- 执行未授权代码

## Mitigations

- 在所有改变状态的请求中使用反 CSRF 令牌
- 检查 Referer 头
- 使用 SameSite Cookie 属性

## Detection

- Total rules: 3
- Languages: javascript, typescript, python, go

## Rules by Language

### Javascript (1 rules)

- **Angular Missing HTTP Security Interceptor** [HIGH]: Missing HTTP interceptors require manual token and CSRF protection on every request,
leading to inconsistent security and unauthorized API access.
  - Remediation: Create an HTTP interceptor to add authentication tokens to all requests.

```typescript
@Injectable()
export class AuthInterceptor implements HttpInterceptor {
  constructor(private auth: AuthService) {}

  intercept(req: HttpRequest<any>, next: HttpHandler) {
    const token = this.auth.getToken();
    if (token) {
      req = req.clone({
        headers: req.headers.set('Authorization', `Bearer ${token}`)
      });
    }
    return next.handle(req);
  }
}
```

Learn more: https://shoulder.dev/learn/typescript/cwe-352/http-interceptor-missing

### Typescript (1 rules)

- **Angular Missing HTTP Security Interceptor** [HIGH]: Missing HTTP interceptors require manual token and CSRF protection on every request,
leading to inconsistent security and unauthorized API access.
  - Remediation: Create an HTTP interceptor to add authentication tokens to all requests.

```typescript
@Injectable()
export class AuthInterceptor implements HttpInterceptor {
  constructor(private auth: AuthService) {}

  intercept(req: HttpRequest<any>, next: HttpHandler) {
    const token = this.auth.getToken();
    if (token) {
      req = req.clone({
        headers: req.headers.set('Authorization', `Bearer ${token}`)
      });
    }
    return next.handle(req);
  }
}
```

Learn more: https://shoulder.dev/learn/typescript/cwe-352/http-interceptor-missing