The fix, in one snippet
<input type=hidden name=csrf_token value="session-bound-token">Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
Scan.now inventories POST forms and looks for hidden fields named like established CSRF tokens. It does not submit the form, so this is a configuration lead rather than proof that server-side validation is absent.
Why it matters
A cross-site request can make a signed-in browser perform an unwanted action when the server does not bind the request to the user's session and origin.
How to fix it
Use framework CSRF middleware, validate a session-bound unpredictable token, check Origin where appropriate and keep SameSite cookies as defence in depth.
Where this fits
POST form without recognisable CSRF protection is check 9 of 19 that the csrf protection scanner runs under page content and javascript, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Open redirect (medium), where a redirect-like GET parameter accepted an external Scan.now URL. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
POST form without recognisable CSRF protection closes one route in. Immediately below it: Structural accessibility basics, where structural HTML checks found missing accessible names, image alternatives, document language or skipped heading levels; Web performance baseline, where the initial response is slow, oversized or contains many parser-blocking scripts; Advertising and tracking endpoints, where which of the page's third-party hosts exist to advertise to the visitor or to follow them, matched against the EasyList and EasyPrivacy blocklists that also power our <a href="/ad-blocker">ad blocker</a>.
Found in the same scan
The csrf protection scanner reports this alongside checks from other categories that are at least as serious, including Path traversal / local file inclusion, where a path-like parameter returned a known local operating-system file signature, and Session token exposed in URL, where a session-like token name appears in a discovered URL. A single run of csrf protection scanner answers all of them at once.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: POST form without recognisable CSRF protection (medium severity)
Scanner check id: csrf-form-protectionThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
