Endpoint accepted a cross-origin state-changing POST
With `--allow-active`, owlwarden POSTs a canary body to `--target` using Origin https://owlwarden-untrusted.invalid. A 2xx response means the route accepted a cross-origin state-changing request - the classic CSRF shape on cookie-session apps. Requires staging you control; the canary may still create a resource if the route is a create endpoint.
high likely application source OWASP A01:2021 / CWE-352
How to fix it
Require a CSRF synchroniser token (or SameSite=Strict session cookies plus Origin checks) before accepting state-changing requests from browsers.
// Reject cross-site state-changing requests without a CSRF token.
// Example (Express):
// app.use(csrfProtection)
// Or set session cookies with SameSite=Strict / Lax and verify Origin.Check your own repository
npx owlwarden scan --preset deep
npx owlwarden explain csrf-cross-origin-post
explain prints the rule and fixes in the terminal. It does not
use the network.