logo

Database

Javascript Manual Csrf Token Handling Fetch

Description

This detector identifies JavaScript fetch API calls that lack proper CSRF (Cross-Site Request Forgery) token handling. When web applications use fetch() for HTTP requests without including CSRF tokens, they become vulnerable to CSRF attacks where malicious sites can trick users into performing unintended actions.

Weakness:

014 - Insecure functionality

Category: Functionality Abuse

Detection Strategy

    • Scans JavaScript code for fetch() API calls

    • Analyzes each fetch call to determine if CSRF protection mechanisms are missing

    • Reports vulnerabilities when fetch requests are made without proper CSRF token inclusion

    • Focuses on state-changing HTTP methods (POST, PUT, DELETE, PATCH) that require CSRF protection

Vulnerable code example

// VULNERABLE: CSRF token extracted from URL parameters
const params = new URLSearchParams(window.location.search);
const token = params.get('csrfToken'); // Token exposed in URL, vulnerable to referrer leakage
fetch('/api/transfer-money', {
    method: 'POST',
    headers: {
        'X-CSRF-Token': token // CSRF protection bypassed via URL manipulation
    }...

✅ Secure code example

// SECURE: CSRF token from meta tag (safe DOM source)
const token = document.querySelector('meta[name="csrf-token"]')?.content;
fetch('/api/transfer-money', {
    method: 'POST',
    headers: {
        'X-CSRF-Token': token // Token safely obtained from DOM, not URL
    },
    credentials: 'include' // Include cookies for additional security...