Cross-Site Request Forgery

In a Cross-Site Request Forgery (CSRF) attack, an untrusted application can cause a user's browser to submit requests or perform actions on the user's behalf.

Read more about CSRF here: https://owasp.org/www-community/attacks/csrf

Cross-Site Request Forgery is flagged by sobelow when a pipeline fetches a session, but does not implement the :protect_from_forgery plug.

CSRF checks can be ignored with the following command:

$ mix sobelow -i Config.CSRF

False positives can be ignored at the pipeline level by adding a # sobelow_skip comment:

# sobelow_skip ["Config.CSRF"]
pipeline :api do
  ...
end

This requires the --skip flag. Listing the parent Config module instead skips every Config check on that pipeline.