Your files stay on your device

CSRF defense configuration checker

Answer a short form or paste your framework config and get layered CSRF findings covering tokens, cookie attributes, and origin checks against framework baselines.

Answer the questions or paste a config to see the layer-by-layer findings.

This is a self-assessment, not a scan. Nothing is fetched, so it cannot see the code you did not describe, the headers your server actually sends, or a CDN stripping the Origin header. The framework baselines describe shipped defaults; your wiring may differ. And none of these layers survives cross-site scripting, which reads the token out of the page no matter how it got there. The paste scan is keyword-level on purpose: unknown means the answer the guided form gives instead.
Options

More web & auth tools

- Cookie analyzer (/web/cookie)
- CSP evaluator & builder (/web/csp)
- HTTP header parser (/web/headers)
All web & auth tools (/web)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/web/csrf-defense-configuration-checker
Markdown version: https://nutter.tools/web/csrf-defense-configuration-checker.md
Plain-text version: https://nutter.tools/web/csrf-defense-configuration-checker.txt
Agent index: https://nutter.tools/llms.txt