Cross-Site Request Forgery

In a Cross-Site Request Forgery (CSRF) attack, an untrusted application can cause a user’s browser to submit requests or perform actions on the user’s behalf.

Read more about CSRF here: https://www.owasp.org/index.php/Cross-SiteRequest_Forgery(CSRF)

Cross-Site Request Forgery is flagged by sobelow when a pipeline accepts “html” requests, but does not implement the :protect_from_forgery plug.

CSRF checks can be ignored with the following command:

$ mix sobelow -i Config.CSRF