Session Management and CSRF Protection Review
Verify state-changing requests and sessions are safe.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
Review session handling and cross-site request protection in my application with a decision tree. Framework and language: [FRAMEWORK_AND_LANGUAGE]. Authentication type: [AUTH_TYPE]. Relevant code (session setup, cookie settings, middleware, and one state-changing endpoint): [PASTE_CODE]. Walk through each node, quoting my code: NODE 1: How is the session stored (server-side or signed token)? If a token, is it revocable on logout and password change? NODE 2: Cookie flags: HttpOnly, Secure, SameSite value. If any is missing, show the line to change. NODE 3: Is the session identifier regenerated after login and privilege change? NODE 4: Idle and absolute timeouts: present and sensible? NODE 5: Do state-changing requests (POST, PUT, PATCH, DELETE) require a CSRF token or an equivalent defense? If the app uses cookies for auth and no defense is found, mark it HIGH. NODE 6: Are any state-changing actions reachable by GET? NODE 7: CORS and origin checks for APIs that use cookies. Output a findings table (node, finding, severity, fix with code) and a test plan with five requests I can send to confirm each fix. Do not claim something is vulnerable if the code you were given does not show it.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.
See an example result (fictional data)
NODE 2: Cookie set at auth.js line 31 with HttpOnly and Secure but no SameSite. Fix: add sameSite: "lax". NODE 3: Session ID is not regenerated after login (line 58). Fix: call regenerate() before storing the user id. NODE 5: POST /account/email has no CSRF token and the app uses cookie auth. Severity: HIGH. Findings table Node | Finding | Severity | Fix 5 | No CSRF defense on 6 state-changing routes | High | Add token middleware or double-submit cookie 4 | No idle timeout | Medium | 30 min idle, 12 h absolute Test: send a POST from a local HTML page while logged in; it should now be rejected with 403.
Illustrative only, made-up data. Your results will differ and must be reviewed.