R14.4: CSRF token validation

Short answer: State-changing forms and endpoints validate anti-CSRF token. Without a token another site can submit your user’s form for them.

Group: Auth and sessions. Status: stable. Generated from the rule definitions; do not edit by hand.

Playground: https://brevio.pro/tools/agent-guard-playground?rule=R14.4

What it catches

CSRF token validation: state-changing forms and endpoints validate anti-CSRF token.

Why

Without a token another site can submit your user’s form for them.

A bad example

<form method="post" action="/transfer">

A good example

<form method="post" action="/transfer">
  <input type="hidden" name="csrf" value={token} />

How it is checked

Nothing yet. No scanner and no slice card checks it: it is a standing rule for authors and reviewers.

How to silence it

A person can silence one finding with brevio-core: ignore R14.4 -- reason on the line or the line above. Without the reason it does not count. An agent cannot silence it: the agent hook and the MCP tools never honour the comment, and a pull request that adds one is reported until a reviewer allows it. Fixing the code is still the better answer.

To change what the rule flags, edit its definition in dev_rules.py or code_rules/__init__.py. That is a code change and is reviewed like one.

R14.5 No credentials in URLs
R14.6 Strict redirect URL allowlist
R14.7 Brute-force throttle
R14.8 Role-based access control
Every rule