no-missing-csrf-protection

Keywords: CSRF, CWE-352, security, ESLint rule, CSRF protection, token validation, middleware, Express, Fastify, LLM-optimized, code security

Detects missing CSRF token validation in POST/PUT/DELETE requests. This rule is part of eslint-plugin-secure-coding and provides LLM-optimized error messages that AI assistants can automatically fix.

💼 This rule is set to error by default in the recommended config.

Quick Summary

Vulnerability and Risk

Vulnerability: Cross-Site Request Forgery (CSRF) occurs when an application processes state-changing requests (like creating users or transferring funds) without verifying that the request originated from a trusted source (usually via a CSRF token).

Risk: An attacker can trick an authenticated user into visiting a malicious site, which then sends a request to the vulnerable application. The browser automatically includes the user's cookies, causing the application to execute the unauthorized action as the victim.

Detection Flow

Why This Matters

Detection Patterns

The rule detects:

• Express routes: app.post(), app.put(), app.delete(), app.patch()
• Route handlers without CSRF middleware in arguments
• Common CSRF middleware patterns: csrf, csurf, csrfProtection, validateCsrf, csrfToken, csrfMiddleware
• Global CSRF middleware: Applied via app.use(csrf())

Examples

❌ Incorrect

// Missing CSRF protection on state-changing routes
app.post('/api/users', (req, res) => {
  // ❌ No CSRF middleware
  // Create user
});

router.put('/api/users/:id', (req, res) => {
  // ❌ No CSRF middleware
  // Update user
});

app.delete('/api/users/:id', handler); // ❌ No CSRF middleware

✅ Correct

// CSRF middleware added
app.post('/api/users', csrf(), (req, res) => {
  // ✅ CSRF middleware
  // Create user
});

router.put('/api/users/:id', csrfProtection, (req, res) => {
  // ✅ CSRF middleware
  // Update user
});

// Global CSRF middleware
app.use(csrf({ cookie: true })); // ✅ Global protection
app.post('/api/users', (req, res) => {
  // ✅ Protected by global middleware
  // Create user
});

// GET requests don't need CSRF
app.get('/api/users', (req, res) => {
  // ✅ GET doesn't need CSRF
  // Return users
});

Error Message Format

The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:

🔒 CWE-352 OWASP:A01 CVSS:8.8 | Cross-Site Request Forgery (CSRF) detected | HIGH
   Fix: Review and apply the recommended fix | https://owasp.org/Top10/A01_2021/

Message Components

Configuration

Default Configuration

{
  "secure-coding/no-missing-csrf-protection": "error"
}

Options

Example Configuration

{
  "secure-coding/no-missing-csrf-protection": [
    "error",
    {
      "allowInTests": true,
      "csrfMiddlewarePatterns": ["csrf", "myCustomCsrf"],
      "protectedMethods": ["post", "put", "delete"],
      "ignorePatterns": ["/api/public"]
    }
  ]
}

Best Practices

1. Protect all state-changing routes: POST, PUT, DELETE, PATCH
2. Use middleware: Leverage Express/Fastify CSRF middleware
3. Global protection: Apply CSRF middleware globally when possible
4. Token validation: Validate CSRF tokens on every protected request
5. GET requests: Don't require CSRF (idempotent operations)

Known False Negatives

The following patterns are not detected due to static analysis limitations:

Values from Variables

Why: Values stored in variables are not traced.

// ❌ NOT DETECTED - Value from variable
const value = userInput;
dangerousOperation(value);

Mitigation: Validate all user inputs.

Wrapper Functions

Why: Custom wrappers not recognized.

// ❌ NOT DETECTED - Wrapper
myWrapper(userInput); // Uses dangerous API internally

Mitigation: Apply rule to wrapper implementations.

Dynamic Invocation

Why: Dynamic calls not analyzed.

// ❌ NOT DETECTED - Dynamic
obj[method](userInput);

Mitigation: Avoid dynamic method invocation.

Related Rules

• no-insecure-cookie-settings - Detects insecure cookie configurations
• no-missing-authentication - Detects missing authentication

Resources

• CWE-352: Cross-Site Request Forgery
• OWASP: CSRF Prevention
• Express CSRF Protection