mediumConfiguration

CSRF Protection Switched Off

Cross-site request forgery protection is turned off.

Why it matters

Browsers send your cookies with any request to your domain, even one a different site started. The CSRF token is what proves the form came from your own page. Turning it off to make a form work usually means the token was missing from the template, which is a one-line fix.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

Flask-WTF CSRF disabled in settings

WTF_CSRF_ENABLED = False

The smallest fix

minimal patch

# Flask-WTF: keep protection on and include the token in the form
<input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
# Django: keep CsrfViewMiddleware and put {% csrf_token %} inside the <form>

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

safe alternative

# For JSON APIs called from JavaScript, send a header the browser will
# not add on its own (Authorization: Bearer ...) and reject requests
# without it. Webhooks from third parties should verify a signature
# instead of being exempted silently.

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

In [the file] at line [the line number] CSRF protection is disabled: [the flagged code]. Re-enable it and add the CSRF token to every HTML form that posts to this app. If the endpoint is a JSON API, require a Bearer token or a custom header instead of exempting it. If it is a webhook, verify the provider's signature.

How to check the fix worked

1. Submit the form from a page on another origin (a local HTML file)
   and confirm a 403.
2. Submit from your own page and confirm it succeeds.