Disabled CSRF (ARCH3125)

Key typescript.security.disabled-csrf · Severity warning · Category security · CWE CWE-352

Disabling CSRF protection on state-changing endpoints lets attackers trigger unintended requests on behalf of a user. Keep token-based CSRF protection enabled.

Incorrect

import csrf from "csurf";

// CSRF middleware intentionally skipped
app.post("/account/transfer", (req, res) => {
  transferFunds(req.user, req.body.amount);
  res.sendStatus(200);
});

Correct

import csrf from "csurf";

const csrfProtection = csrf({ cookie: true });
app.post("/account/transfer", csrfProtection, (req, res) => {
  transferFunds(req.user, req.body.amount);
  res.sendStatus(200);
});

Fix

Apply CSRF token validation to every state-changing POST/PUT/DELETE endpoint.