csrf_prescan report — 9 file(s), 12 finding(s)

HIGH   CSRF-PROTECTION-DISABLED   app/routes.rb:12  explicit CSRF-protection opt-out — cross-site POSTs reach this handler with only the ambient cookie
       | skip_before_action :verify_authenticity_token, only: [:stripe]
HIGH   CSRF-PROTECTION-DISABLED   app/views.py:5  explicit CSRF-protection opt-out — cross-site POSTs reach this handler with only the ambient cookie
       | @csrf_exempt
HIGH   CSRF-PROTECTION-DISABLED   config/SecurityConfig.java:4  explicit CSRF-protection opt-out — cross-site POSTs reach this handler with only the ambient cookie
       | .csrf().disable()
HIGH   CSRF-PROTECTION-DISABLED   config/settings.py:2  explicit CSRF-protection opt-out — cross-site POSTs reach this handler with only the ambient cookie
       | WTF_CSRF_ENABLED = False
MEDIUM CSRF-MUTATING-GET          app/routes.rb:2  mutating verb bound to a GET route — reachable via <img>/<a>/prefetch with no CSRF check
       | get 'photos/:id/destroy'
MEDIUM CSRF-NULL-SESSION          app/routes.rb:8  protect_from_forgery with :null_session/:reset_session — forgery fails soft instead of raising
       | protect_from_forgery with: :null_session
MEDIUM CSRF-NO-TOKEN-CHECK        app/routes/account.js:6  mutating handlers over cookie/session auth and no csrf/xsrf/antiforgery marker anywhere in the file
       | router.post('/password', (req, res) => {
MEDIUM CSRF-MUTATING-GET          app/server.js:7  mutating verb bound to a GET route — reachable via <img>/<a>/prefetch with no CSRF check
       | app.get('/admin/disable-user/:id', (req, res) => {
MEDIUM CSRF-EXCEPTION-LIST        config/settings.py:1  partial CSRF exemption — listed routes/origins skip the token check
       | CSRF_TRUSTED_ORIGINS = ["https://admin.internal.example"]
MEDIUM CSRF-TOKEN-ABSENT-FORM     templates/checkout.html:1  POST/PUT/DELETE/PATCH form with no csrf/xsrf/authenticity-token field in its block
       | <form method="post" action="/checkout">
LOW    CSRF-SAMESITE-NONE         app/server.js:16  SameSite=None — cookie rides every cross-site request; needs a token or Origin/Sec-Fetch-Site check
       | res.cookie('sid', req.body.sid, {sameSite: 'none', secure: true});
LOW    CSRF-TOKEN-IN-URL          app/server.js:19  csrf/authenticity token in a query string — leaks via logs, Referer and history
       | app.get('/share', (req, res) => res.redirect('/x?_csrf=' + req.user.tok));

scope: deterministic pre-scan — flags protection opt-outs and token-absent mutation surfaces; not an audit, clean != CSRF-safe