CSRF Risk Calculator

Likelihood = mean(token strength, SameSite attribute, request shape, step-up authentication); impact = value of the forged action plus a scale uplift for the exposed user base. SameSite=Lax already blocks cross-site form POSTs in current browsers, so the residual likelihood depends on whether state changes are reachable by top-level GET and whether any user still runs a browser without the default. Impact is the worth of one forged action multiplied out across the exposed user base.

CSRF is the cheapest attack to launch — a hidden form on any page the victim visits — and the cheapest to fix, so a Medium or higher here is almost always a missing one-line middleware.

This calculator takes 6 inputs: Anti-CSRF token, SameSite attribute on the session cookie, Shape of the state-changing request, Step-up authentication on sensitive actions, Value of the forged action, Authenticated users exposed. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Not for defence in depth. Lax blocks cross-site POST but still sends the cookie on top-level GET navigations, so any state change reachable by GET remains forgeable, and cookies without an explicit attribute behave inconsistently across browsers and API clients. Keep a token as well.