CSRF Methods Guide & Assessment

CSRF is defeated in layers, not spells. CSRF Methods Guide explains the eight standard defenses — tokens, cookies, headers, policies and signatures — with effort, effectiveness and step-by-step setup for each.

Then run the self-assessment: tick what you already do, and the guides list the missing layers.

• 8 defense methods — effort and effect at a glance.
• Step-by-step setup — pick a method, get its steps.
• Live filter — search by name, class or use-case.
• Self-assessment — missing layers revealed.
• Copyable verdict — take it to the review.

1. Scan the eight methods and their classes.
2. Open one to see exact implementation steps.
3. Tick the defenses your app already runs.
4. Assess — gaps are listed by priority.

Example 1 — FastAPI + SPA. A JSON API with no server-rendered forms should use the custom-header method plus SameSite.

Example 2 — Rails/Django form app. The synchronizer token is built in — the guide confirms you also need SameSite and Origin validation.

Example 3 — Payment webhook endpoint. HMAC signing ties the request to a secret only your server knows.

• Coverage check — gaps made explicit.
• Implementation steps — no theory only.
• Effort lens — match method to risk.
• Private — all in-browser.