Baseline · Auth & access control
B-04 Sensitive operations have CSRF protection
highmanual review
Why it matters
State-changing requests validate their origin against forgery.
How to test
Craft a cross-site state-changing request and see if it succeeds.
How to fix
Add CSRF tokens or SameSite=strict cookies.