Rate cross-site request forgery exposure from token design, SameSite cookies, request shape and the value of the forged action.
SameSite=Lax already blocks cross-site form POSTs in current browsers, so the residual likelihood depends on whether state changes are reachable by top-level GET and whether any user still runs a browser without the default. Impact is the worth of one forged action multiplied out across the exposed user base. CSRF is the cheapest attack to launch — a hidden form on any page the victim visits — and the cheapest to fix, so a Medium or higher here is almost always a missing one-line middleware.
CSRF Risk
Likelihood = mean(token strength, SameSite attribute, request shape, step-up authentication); impact = value of the forged action plus a scale uplift for the exposed user base.
Likelihood = mean(token strength, SameSite attribute, request shape, step-up authentication); impact = value of the forged action plus a scale uplift for the exposed user base. SameSite=Lax already blocks cross-site form POSTs in current browsers, so the residual likelihood depends on whether state changes are reachable by top-level GET and whether any user still runs a browser without the default. Impact is the worth of one forged action multiplied out across the exposed user base.
CSRF is the cheapest attack to launch — a hidden form on any page the victim visits — and the cheapest to fix, so a Medium or higher here is almost always a missing one-line middleware.
This calculator takes 6 inputs: Anti-CSRF token, SameSite attribute on the session cookie, Shape of the state-changing request, Step-up authentication on sensitive actions, Value of the forged action, Authenticated users exposed. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Not for defence in depth. Lax blocks cross-site POST but still sends the cookie on top-level GET navigations, so any state change reachable by GET remains forgeable, and cookies without an explicit attribute behave inconsistently across browsers and API clients. Keep a token as well.