More screenshots

    Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIDeepSeekDeepSeekMuseMuse+22 more

    Repair CSRF Session Boundary Bugs

    1

    Repair CSRF and session-boundary bugs involving token rotation, Origin/Referer checks, login/logout transitions, SameSite assumptions, multi-tab state, unsafe methods, and stale session generations.

    $1

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    Repair CSRF Session Boundary Bugs

    Repair CSRF Session Boundary Bugs

    Example session with this skill installed

    Our SPA keeps one CSRF token for the browser lifetime. After logout/login as another user, the same token is still accepted because it is not tied to the server session. Repair with local request fixtures and keep existing auth/session lifetime policy.

    • Read your context and instructions
    • Compiled the repair csrf session

    The CSRF token has browser lifetime instead of authenticated-session lifetime. The repair binds validation to the active session generation, rotates/invalidates it at existing login/logout boundaries, preserves Origin/SameSite policy, and tests account switch, multi-tab logout, old token replay, safe/unsafe methods, and allowed-origin behavior.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    The problem

    CSRF and session handling often break due to inconsistent state ownership, race conditions in multi-tab environments, or mismatched trust boundaries across components. Manually tracing these leaky abstractions leads to regression bugs or accidental security downgrades.

    What it does

    • Identifies and repairs inconsistent CSRF token binding and session rotation logic.
    • Reconstructs concurrent timelines to fix race conditions in multi-tab behavior and token consumption.
    • Relocates validation logic to occur before irreversible state mutations or dispatches.
    • Synchronizes Origin, Referer, and SameSite policies across the entire repository.
    • Generates deterministic local test fixtures and redacted observability metrics for regression testing.

    Why this beats prompting it yourself

    General prompts often suggest "quick fixes" like disabling validation or increasing timeouts, which introduce security risks. This skill enforces strict safety rules that preserve existing authentication policies and session lifetimes while ensuring repairs are verifiable through local loopback tests.

    Use cases

    • Fixing 403 Forbidden errors caused by CSRF token expiration in multi-tab web apps.
    • Hardening session boundaries during login/logout state transitions.
    • Aligning SameSite cookie attributes with modern browser security requirements.
    • Adding redacted logging to session lifecycle events for easier debugging.

    Known limitations

    Operates strictly on repository files and local fixtures. Cannot access production services, live secrets, or customer data.

    Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for Security.

    Cannot redesign authentication/authorization policy, allowed origins, SameSite policy, session lifetime, API compatibility, and public errors; cannot verify production infrastructure or prove every runtime, proxy, network, filesystem, or scheduler ordering.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before buying a skill.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 2 months ago

    Permissions

    Terminal / Shell
    Read Files
    Write Files

    Run on a clean branch with repository files and disposable local fixtures. Review patches and validation before merge. Keep production services, real credentials, customer payloads, and deployment out of scope.

    Listed2 months ago
    Updated9 days ago

    What's inside

    Frequently Asked Questions

    This skill targets complex vulnerabilities like race conditions in multi-tab environments, mismatched SameSite cookie policies, and improper session rotation during login/logout transitions that standard linters often miss.

    The skill is designed to work with most major LLMs (like GPT-4o or Claude 3.5 Sonnet) that support repository-wide analysis and code manipulation through developer-focused AI agents.

    No, the skill operates strictly on your local repository and test fixtures; it does not require or allow access to production databases, live secrets, or sensitive customer PII.

    You receive the specialized logic for the AI agent, comprehensive integration instructions, and a set of local test fixtures to verify the repairs within your development workflow.

    The skill reconstructs concurrent timelines to identify where tokens become stale across different browser contexts, then implements logic to ensure token consumption is synchronized and valid for all active tabs.

    New in Security