Anti-CSRF Token From Referer
Summary: PortSwigger's BApp Store lists a Burp Suite extension called "Anti-CSRF token from referer," built by Compass Security at version 0.1 and last updated 28 February 2020. The extension registers a session handling rule that finds the anti-CSRF token parameter in GET, POST, JSON and multipart requests, issues a GET to the original request's referer with headers such as Cookie and Authorization copied over, extracts the token between configured start and end markers, and replaces it in the original request.
What you should know: The extension copies session headers like Cookie and Authorization onto a request to the referer, so a security leader should weigh what that replay does against the targets in scope before enabling it in a testing workflow.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026