Disabled CSRF (ARCH7125)

Key php.security.disabled-csrf · Severity warning · Category security · CWE CWE-352

Disabling CSRF protection on a state-changing endpoint lets an attacker forge requests using the victim’s authenticated session.

Incorrect

<?php
// Laravel: route excluded from CSRF middleware
protected $except = [
    'account/transfer', // all transfers unprotected
];

Correct

<?php
// Form includes a CSRF token, middleware verifies it
Route::post('/account/transfer', [TransferController::class, 'store'])
    ->middleware('web'); // VerifyCsrfToken active

Fix

Keep CSRF protection enabled on all state-changing routes; for genuine API endpoints use stateless auth (Bearer tokens) instead of disabling the token.