Group
  • Security

    Add CSRF protection to my forms and mutations

    Adds anti-CSRF tokens or SameSite defenses to every state-changing form and endpoint.

    • Improve quality
    • Intermediate
    • General

Free Prompt

Add CSRF protection to my app. Look at every form and every endpoint that changes state (POST, PUT, PATCH, DELETE), especially ones that rely on cookies for authentication. Implement one of these approaches, choosing based on what's already in the project: anti-CSRF tokens embedded in forms and validated on the server, the SameSite cookie attribute combined with a custom header check for API requests, or an established CSRF middleware for my framework. If I already have partial protection, extend it to cover everything rather than replacing it. Do not break existing forms or API clients while adding protection. Do not add token requirements to safe read-only GET endpoints. Make sure failed CSRF validation returns a clear 403 response instead of a generic 500. List every form and endpoint you protected and the mechanism used. Then give me a verification step: how to confirm a forged cross-site request (one without the token) is rejected, using a simple HTML form or curl request.

What This Does / How This Helps

Adds CSRF defenses to every form and state-changing endpoint, so a malicious site can't trick a logged-in user's browser into submitting requests on their behalf. CSRF is the attack where a victim visits an innocent-looking page that silently submits a form to your app using their active session: change email, transfer funds, delete account. Apps built quickly almost never include token validation, and browsers won't save you on their own in every case. The prompt picks the approach that fits your stack, keeps read endpoints untouched, and leaves you with a forge-and-fail test to prove it works.

Want to skip doing this by hand?

Fortivibe audits your app for all of the areas these prompts cover (and more).

See What We Check

Related Prompts

  • Security

    Add rate limiting to my public endpoints

    Protects login, signup, and API routes from brute force and abuse with sensible limits and lockout responses.

    • Improve quality
    • Plan & validate
    • Intermediate
    • General
  • Security

    Add request body size limits

    Caps payload sizes on every endpoint so huge requests can't exhaust memory or disk.

    • Improve quality
    • Beginner
    • General
  • Security

    Add two-factor authentication to my app

    Implements TOTP-based 2FA with recovery codes and clean enrollment, without locking existing users out.

    • Improve quality
    • Plan & validate
    • Advanced
    • General