Detecting and protecting against inconsistent use of cross-site request forgery mitigation features

A device comprising:

• one or more processors;
• and
• a computer-readable storage medium having encoded thereon computer-executable instructions that cause the one or more processors to:
• receive, with the one or more processors, a source code for a web application;
• open the source code;
• scan the opened source code to identify a framework used by the source code;
• and
• generate an indication of a cross-site request forgery vulnerability within the opened source code based on a framework-based static analysis determination that:
• a feature of the framework is not applied to an authentication function within the source code, wherein the feature causes an anti-forgery token to be generated when the authentication function is executed, and wherein the feature causes the anti-forgery token to be included in a cookie when the authentication function is executed.

A computer-readable storage media storing instructions that, when executed by a processor, cause the processor to:

• receive a source code for a web application, the source code including a server-side source code and a client-side source code;
• open the server-side source code;
• scan the opened server-side source code to identify a framework used by the server-side source code;
• open the client-side source code;
• scan the opened client-side source code to identify a web framework used by the client-side source code;
• and
• verify that the server-side source code and the client-side source code do not include a cross-site request forgery vulnerability based on a determination that:
• a first feature of the framework is applied to an authentication function within the server-side source code, wherein the first feature causes an anti-forgery token to be generated and included in a cookie when the authentication function is executed,
• a second feature of the web framework is correctly applied within the client-side source code, wherein the second feature causes the anti-forgery token to be copied from the cookie to an HTML form within a web response, and
• a third feature of the framework is applied to a server-side function that responds to a web request that includes the HTML form, wherein the third feature verifies that the anti-forgery token included in the cookie matches the anti-forgery token included in the HTML form included in the web request.