SH107: CSRF protection disabled

Severity: medium · Category: authentication · Applies to: aspnet, django, fastapi, flask, spring

Why it matters

Without CSRF protection a malicious page can make a signed-in visitor's browser submit requests to your application. Disabling it is only safe for APIs that never authenticate with cookies.

How to fix

Keep CSRF protection on for cookie-based sessions; disable it only for stateless token APIs, and scope the exemption to those endpoints.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH107

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH107