CSRF Protection

What this check looks for

StackShield inspects your state-changing endpoints for the presence and enforcement of CSRF protection: whether forms carry a token, whether the application rejects requests that lack a valid one, and whether routes that mutate data are guarded rather than open.

Laravel ships CSRF protection by default. The check is reading whether it is still in force, or whether it has been disabled, excepted or bypassed.

Why it matters

Cross-site request forgery tricks a logged-in user's browser into making a request they did not intend. If your state-changing routes accept requests without verifying they came from your own forms, an attacker can craft a page that, when your authenticated user visits it, silently changes their email, transfers a balance or elevates a permission, using the user's own session.

The vulnerability is not in the attacker's page; it is in your endpoint trusting any request that carries a valid session cookie, regardless of where it originated.

What a failed check means

A failed check means a state-changing route was reachable without CSRF enforcement, often because the middleware was removed, the route was added to the CSRF exception list, or a form omits the token. Each unguarded route is one an attacker can trigger on behalf of a logged-in victim.

The fix is ensuring the CSRF middleware is active, the @csrf directive is present in forms, and the exception list contains only routes that genuinely need it, such as stateless webhook receivers.

See the step-by-step remediation: how to fix this.