CSRF Defense Configuration Checker
Paste configuration or header notes and check which common CSRF defenses are mentioned.
Runs in your browser. Nothing is uploaded — your input is processed on this device and discarded when you close the tab.
CSRF Defense Configuration Checker
How to use this tool
- Enter your values in the fields above.
- Press Generate to see the result.
- Use Load sample to try the worked example, Copy result to copy it, or Clear to start again.
Worked example
Pasting notes mentioning a CSRF token, SameSite=Lax and an Origin check reports 4 of those defenses present (token, SameSite mention, Origin check, and the SameSite=Lax value).
What this tool does not do / Limits
This tool only scans notes you paste here. It does not test, verify or attack any live site, and a mention is not proof of correct implementation.
Frequently asked questions
Does this prove my site is safe from CSRF?
No. It only checks what your pasted notes mention; correct implementation still needs real request testing.
Does it test my live site?
No. It never contacts any site; it only reads the text you paste.
Related tools
JSON Studio
Format, validate, minify, query and compare JSON in your browser, with precise line-and-column errors.
LiveRegex Tester
Test patterns against sample text with match highlighting, capture groups and a safe one-second timeout.
LiveSecurity Header and DNS Checker
Check HSTS, CSP and other security headers, TLS details, and DNS/email authentication records (SPF, DKIM, DMARC).
Live