<p>After the page loads with the form loads, delete the CSRF cookie, then submit the form.  It should fail CSRF token validation.</p>

CC BY-SA 3.0
2014-10-31T21:39:42.523Z
2014-10-31T22:48:13.737Z
2014-10-31T22:48:13.737Z
Brad Bell
<p>Craft supports enabling CSRF protection on our front-end forms.  They even have a nice, easy-to-follow, help page called "<a href="http://buildwithcraft.com/help/csrf-protection" rel="nofollow">How do I enable CSRF protection?</a>"</p>

<p>Let's say we pull that all off without a hitch. Our forms output the csrfTokenName and csrfToken and the browser cookie is generated just as expected.</p>

<p>Now, how do we test if it is actually working?  Are there any steps an average, not-very-technical developer can take to see if CSRF protection is behaving as expected?</p>

<security><csrf>
How do I test if Craft CSRF Protection is properly enabled?
# How do I test if Craft CSRF Protection is properly enabled?

(Asked by: username_0 on 2014-10-31)

Craft supports enabling CSRF protection on our front-end forms. They even have a nice, easy-to-follow, help page called "[How do I enable CSRF protection?](http://buildwithcraft.com/help/csrf-protection)"

Let's say we pull that all off without a hitch. Our forms output the csrfTokenName and csrfToken and the browser cookie is generated just as expected.

Now, how do we test if it is actually working? Are there any steps an average, not-very-technical developer can take to see if CSRF protection is behaving as expected?

**Tags:** security, csrf

---

## 1 answers

### Answer by username_1 on 2014-10-31. Score: 2

After the page loads with the form loads, delete the CSRF cookie, then submit the form. It should fail CSRF token validation.


---

