Your files stay on your device

# CSRF defense configuration checker

Answer a short form or paste your framework config and get layered CSRF findings covering tokens, cookie attributes, and origin checks against framework baselines.

Answer the questions or paste a config to see the layer-by-layer findings.

This is a self-assessment, not a scan. Nothing is fetched, so it cannot see the code you did not describe, the headers your server actually sends, or a CDN stripping the Origin header. The framework baselines describe shipped defaults; your wiring may differ. And none of these layers survives cross-site scripting, which reads the token out of the page no matter how it got there. The paste scan is keyword-level on purpose: unknown means the answer the guided form gives instead.
Options

## More web & auth tools

- [Cookie analyzer](/web/cookie)
- [CSP evaluator & builder](/web/csp)
- [HTTP header parser](/web/headers)
[All web & auth tools](/web)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/web/csrf-defense-configuration-checker
Markdown version: https://nutter.tools/web/csrf-defense-configuration-checker.md
Plain-text version: https://nutter.tools/web/csrf-defense-configuration-checker.txt
Agent index: https://nutter.tools/llms.txt