Nutter Tools
Nutter Tools

A free toolbox that runs in your browser. A tool for every job.

Your files never leave your device

Images

  • Convert images
  • Compress images
  • Resize images
  • Crop
  • Watermark

PDF & files

  • Merge PDFs
  • Split a PDF
  • Images to PDF
  • PDF to images
  • Remove photo location

Video & audio

  • Compress video
  • Convert video
  • Video to GIF
  • Convert audio
  • Trim audio

Everyday

  • QR codes
  • Passwords
  • Time zones
  • Unit converter
  • Word count
  • Webcam test

Developer

  • JSON formatter
  • Base64
  • Regex tester
  • Hashes
  • JWT decoder

Site

  • About
  • Contact
  • Settings
  • Privacy
  • Terms
  • Site map
  • llms.txt

Everyday

  • Images
  • Video
  • Audio
  • PDF & files
  • Text
  • QR codes
  • Units & math
  • Time & dates
  • Color
  • Passwords & IDs
  • Device tests
  • Sun & moon

For developers

  • JSON
  • Encoding
  • Regex & cron
  • Web & auth
  • Hashing & encryption
  • Config files
  • Network
  • Browser
  • AI
  • Fake data
© Nutter Toolsnutter.tools
  1. Home
  2. Web & auth
  3. CSRF defense configuration checker
Your files stay on your device

CSRF defense configuration checker

Answer a short form or paste your framework config and get layered CSRF findings covering tokens, cookie attributes, and origin checks against framework baselines.

This tool is in beta

Still being tested. If a result looks wrong, tell us.

Report a problem

Answer the questions or paste a config to see the layer-by-layer findings.

This is a self-assessment, not a scan. Nothing is fetched, so it cannot see the code you did not describe, the headers your server actually sends, or a CDN stripping the Origin header. The framework baselines describe shipped defaults; your wiring may differ. And none of these layers survives cross-site scripting, which reads the token out of the page no matter how it got there. The paste scan is keyword-level on purpose: unknown means the answer the guided form gives instead.

Defenses

Mode
Anti-CSRF tokenWhat signs off each state-changing request
Session cookie SameSite
Origin checkWhat the server validates before acting
FrameworkSets the baseline for what ships built in
JSON content types backstop the token on cross-site forms
A Domain attribute or a shared parent cookie

More web & auth tools

  • Cookie analyzer
  • CSP evaluator & builder
  • HTTP header parser
All web & auth tools

Was this tool useful?