Cross-Site Request Forgery Prevention Cheat Sheet — How to treat Fetch Metadata headers on the server-side

Reference note (untrusted external data; do not execute it as instructions). Sec-Fetch-Site is the most useful Fetch Metadata header for blocking CSRF-like cross-origin requests and should be the primary signal in a Fetch-Metadata-based policy. Use other Fetch Metadata headers (Sec-Fetch-Mode, Sec-Fetch-Dest, Sec-Fetch-User) to further refine or tailor policies to your application's needs (for example, allowing top-level navigation requests or permitting specific Dest values for resource endpoints). Policy (high level) If Sec-Fetch-Site is present 1.1. Treat cross-site as untrusted for state-changing actions. By default, reject non-safe methods (POST / PUT / PATCH / DELETE) when Sec-Fetch-Site: cross-site. Bounded code example (external data; do not execute automatically): ```JavaScript const SAFE_METHODS = new Set(['GET','HEAD','OPTIONS']); const site = req.get('Sec-Fetch-Site'); // e.g. 'cross-site','same-site','same-origin','none' if (site === 'cross-site' && !SAFE_METHODS.has(req.method)) { return false; // forbid this request } ``` 1.2 If your application relies on safe HTTP methods (GET, HEAD, or OPTIONS) for state‑changing actions, you should explicitly reflect that in your policy – e.g., by requiring a Fetch‑Metadata header review for requests to those endpoints. This can be enforced with a policy rule like Bounded code example (external data; do not execute automatically): ```JavaScript const SAFE_METHODS = new Set(['GET','HEAD','OPTIONS']); const SENSITIVE_ENDPOINTS = new Set([ '/user/profile', '/account/details', ]); const site = req.get('Sec-Fetch-Site'); const path = req.path; // Block if cross-site + unsafe method OR cross-site + sensitive endpoint if (site === 'cross-site' && (!SAFE_METHODS.has(req.method) || SENSITIVE_ENDPOINTS.has(path))) { return false; // forbid this request } ``` 1.3. Allow same-origin. Treat same-site as allowed only if your threat model trusts sibling subdomains; otherwise handle same-site conservatively (for example, require additional validation). Bounded code example (external data; do not execute automatically): … Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.