Contact
Open source · Security & Privacy

CSRF Fixture Tester

Compare recorded CSRF middleware decisions with local request fixtures and declared policy; it sends no requests.

v0.1.0 · Node.js 22+ · MIT

Browse the public repository · View releases

Offline, read-only comparison of abstract CSRF request fixtures against recorded local middleware decisions. It consumes no live target URL, executes no middleware, creates no exploit page, and sends no request. The caller's unit harness records observedDecision; this checker tests whether those recorded decisions match a declared origin/token policy. Node.js 22+, zero dependencies. src/index.mjs exports evaluateCsrfFixtures(fixtures, policy, {now, deadline}) and TOOLID.

This walkthrough uses the tool's public README and checked-in example files. Run the command from a repository checkout with Node.js 22+.

Run the checked-in example

node bin/csrf-fixture-tester.mjs --root examples --policy policy.json --fixtures passing-fixtures.json
node bin/csrf-fixture-tester.mjs --root examples --policy policy.json --fixtures failing-fixtures.json

Read the result

The synthetic examples exit 0 and 1. --help prints usage to stderr; normal runs print a bounded human summary to stderr. Stdout contains only the v1 JSON report.