Articles

How can we help?

Answers from the HostedScan team on setting up scans, internal network scanning, reports, and billing, and on fixing scans that fail or run long.

HostedScan Security

Configuration

How do I add anti-csrf tokens to the ZAP web application scanner?

Configuration

How do I add anti-csrf tokens to the ZAP web application scanner?

See the anti-CSRF token fields that the ZAP web application scanner detects by default, and add your application's own token names to the target you scan.

Last updated on 28 Oct, 2026

The ZAP web application scanner is capable of detecting anti-csrf token fields. The default list of anti-csrf token fields used by HostedScan is:

JavaScript "anticsrf",<br>"CSRFToken",<br>"__RequestVerificationToken",<br>"csrfmiddlewaretoken",<br>"authenticity_token",<br>"OWASP_CSRFTOKEN",<br>"anoncsrf",<br>"csrf_token",<br>"_csrf",<br>"_csrfSecret",<br>"__csrf_magic",<br>"CSRF",<br>"_token",<br>"_csrf_token",<br>"_csrfToken",<br>"_wpnonce",<br>"data[_Token][key]

Custom anti-csrf tokens

To configure custom anti-csrf tokens, edit the target you are scanning, add the anti-csrf tokens, and then run a scan to get results with the new configuration.

Image
Did you find this article helpful?
Previous

Why did a scan return a cached result?

Next