PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchTo scrape an endpoint protected by a CSRF header, reproduce the website’s authorized client flow: obtain the token from the page, bootstrap response, cookie, or documented API; retain the required session; send the token in the exact header the server validates; and check the response. There is no universal token value, header name, or scraper shortcut. A made-up X-CSRF-Token header will not pass a server-side check.
What a CSRF header does
Cross-site request forgery (CSRF) abuses a browser’s habit of automatically attaching credentials, especially session cookies. A malicious page can try to make an already authenticated browser submit an unwanted action. The application therefore requires an additional value that an attacker’s page should not be able to read.
In the synchronizer-token pattern, the server issues an unpredictable, secret token for the user session and validates the token returned with a state-changing request. JavaScript clients commonly return it in a custom header. OWASP calls this pattern “one of the most popular and recommended methods to mitigate CSRF.” Read the primary guidance in the OWASP CSRF Prevention Cheat Sheet and MDN’s CSRF reference.
Header names are application-specific. Common examples include X-CSRF-Token, X-XSRF-Token, CSRF-Token, and X-CSRFToken; they are not interchangeable standards.
#1 Best Overall
Before you write a scraper
Confirm authorization and the endpoint
Only automate a site and account you own or are expressly permitted to access. Identify the exact endpoint, HTTP method, authentication mechanism, required content type, rate limits, and whether the operation changes state. Treat the site’s API documentation and frontend code as the authority rather than guessing from a similar framework.
Classify the request correctly
OWASP generally treats GET, HEAD, and OPTIONS as safe methods and POST, PUT, PATCH, and DELETE as state-changing methods. That is a convention, not proof: an application must not mutate data through a nominally safe method, and your scraper should verify actual behavior. Put CSRF handling on every protected state-changing request.
Map the token lifecycle
- Issued where: an HTML meta tag, hidden form field, bootstrap JSON, response header, or cookie.
- Stored how: in the session’s page state, a cookie jar, or an application-specific client store.
- Returned how: the exact custom header or form field expected by the server.
- Scoped how: to a user session, origin, tenant, or short expiration period.
Do not assume a token is static, reusable between accounts, valid after login, or safe to place in a URL. OWASP recommends session-unique, secret, unpredictable tokens and warns against exposing them in URLs or logs.
Browser-style workflow
- Start a session. Use one persistent cookie jar for the bootstrap request and the protected request. A token copied into a different session commonly fails.
- Load the intended page or bootstrap endpoint. Inspect the authorized frontend’s network calls or documentation to find where the token is supplied.
- Extract the value without logging secrets. Parse the documented meta element, JSON property, hidden input, response header, or cookie.
- Send the exact header. Match capitalization where required by the application, although HTTP field names are generally case-insensitive. Send the expected content type, origin-related headers, and authentication context.
- Use the server result as the authority. A 403 or CSRF-specific error means the flow is incomplete; do not “fix” it by randomly adding headers.
Python example with requests
The following template is for an application that documents a token in a meta element and expects X-CSRF-Token. Replace the URLs and selector with the values from the system you are authorized to automate.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesimport requests
from bs4 import BeautifulSoup
BASE = "https://example.com"
FORM_PAGE = f"{BASE}/account/settings"
UPDATE_URL = f"{BASE}/api/account/settings"
with requests.Session() as session:
session.headers.update({
"User-Agent": "authorized-settings-client/1.0",
"Accept": "text/html,application/xhtml+xml,application/json",
})
page = session.get(FORM_PAGE, timeout=30)
page.raise_for_status()
soup = BeautifulSoup(page.text, "html.parser")
meta = soup.select_one('meta[name="csrf-token"]')
if not meta or not meta.get("content"):
raise RuntimeError("CSRF token was not found in the documented location")
token = meta["content"]
response = session.patch(
UPDATE_URL,
headers={
"X-CSRF-Token": token,
"Accept": "application/json",
"Content-Type": "application/json",
},
json={"display_name": "New name"},
timeout=30,
)
response.raise_for_status()
print(response.json())If the token is in a hidden input, parse that input instead. If the application returns it in a response header or cookie, read that documented location and still keep the same Session. Never print the token, cookies, Authorization value, or full request headers in production logs.
Equivalent cURL and Node.js patterns
cURL
Use a cookie file so both requests share the authenticated session. The extraction command must match the application’s actual markup; this example assumes a meta tag.
curl -c cookies.txt -b cookies.txt -sS https://example.com/account/settings -o page.html
TOKEN=$(sed -n 's/.*name="csrf-token"[^>]*content="([^"]*)".*/1/p' page.html)
curl -c cookies.txt -b cookies.txt -sS -X PATCH
-H "X-CSRF-Token: $TOKEN"
-H "Content-Type: application/json"
--data '{"display_name":"New name"}'
https://example.com/api/account/settingsFor complex HTML, use a real parser rather than relying on a fragile regular expression.
Node.js
Node’s built-in fetch does not provide a browser cookie jar. Use an approved cookie-jar library or explicitly carry cookies according to the application’s policy. The example shows the sequencing and token extraction; adapt cookie handling to your environment.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
import * as cheerio from "cheerio";
const page = await fetch("https://example.com/account/settings");
if (!page.ok) throw new Error(`Bootstrap failed: ${page.status}`);
const html = await page.text();
const $ = cheerio.load(html);
const token = $('meta[name="csrf-token"]').attr("content");
if (!token) throw new Error("Missing CSRF token");
const update = await fetch("https://example.com/api/account/settings", {
method: "PATCH",
headers: {
"X-CSRF-Token": token,
"Content-Type": "application/json",
"Accept": "application/json"
},
body: JSON.stringify({ display_name: "New name" })
});
if (!update.ok) throw new Error(`Update failed: ${update.status}`);
console.log(await update.json());In a real authenticated flow, ensure the bootstrap and update requests use the same cookie jar, proxy, and account context. If the token is generated by JavaScript after page load, a plain HTTP client may need the documented bootstrap API or an authorized browser automation session.
Token patterns you may encounter
Synchronizer token
The server stores a token associated with the session and compares it with the value in your header or form body. Obtain it through the application’s intended response and return it unchanged. Never invent or transform it.
Cookie-to-header or double-submit pattern
Some applications issue a token cookie and require the client to copy its value into a header. This is not automatically correct for every site. OWASP cautions that a naive double-submit design can be vulnerable to cookie injection and prefers signed, session-bound tokens. Follow that application’s documented algorithm, including any signing or binding rules.
Header, origin, and Fetch Metadata checks
An application may additionally inspect Origin, Referer, Sec-Fetch-Site, or related Fetch Metadata headers. SameSite cookies and Fetch Metadata are defense-in-depth signals, not substitutes for authentication, authorization, and the application’s CSRF check. Older or embedded browsers may omit Fetch Metadata, so servers using it need an origin-verification fallback.
Why browser CORS explanations do not automatically protect a scraper
Browsers restrict cross-origin JavaScript and may preflight a request containing a custom header. Making a request non-simple can prevent an untrusted webpage from submitting it through browser APIs. A standalone scraper is not automatically subject to same-origin policy or preflight, however. Setting X-CSRF-Token yourself does not recreate browser security and does not grant permission. The server must validate the token, session, origin policy, authentication, and authorization.
Troubleshooting failures
403 or “CSRF token invalid”
- The token came from a different session: reuse one cookie jar.
- The token expired or rotated after login: fetch a fresh bootstrap response.
- The header name or prefix is wrong: copy the exact frontend/API contract.
- The endpoint expects a form field instead of a header, or a signed value instead of the raw cookie.
Token not found
- The page is a shell and JavaScript obtains the token later; locate the documented bootstrap request.
- You received a login page, consent page, bot check, or redirect; inspect final URL and status before parsing.
- Markup changed; use a stable documented selector or API rather than brittle text matching.
401, 419, or unexpected redirect
These usually indicate missing or expired authentication, a lost session cookie, an incorrect host, or a required login/refresh sequence. Do not treat a CSRF header as authentication.
Browser succeeds but HTTP client fails
Compare the authorized browser request with your request: cookies, method, URL, query, content type, body encoding, origin, user agent, redirects, and timing. Reproduce only what the application requires and respect rate limits. Do not attempt to defeat a CAPTCHA or bot-control system.
Operational and security practices
- Prefer a documented API with a scoped service account over scraping a UI.
- Throttle requests, cache read-only results, use bounded timeouts, and implement exponential backoff for transient 5xx responses.
- Redact tokens and cookies from logs, traces, crash reports, and URLs.
- Keep state-changing tests pointed at a sandbox or test account; add idempotency controls where the API supports them.
- Validate response status and content type before parsing, and treat unexpected HTML as a possible login or block page.
- Do not use nominally safe methods to change state, and do not bypass access controls.
Or skip the browser setup
If your goal is a rendered image or PDF rather than structured data, ScreenshotNeo can make the capture request for you. It supports custom headers and cookies, so an authorized workflow can provide the application’s required CSRF context; it does not create permission or bypass the site’s validation. Its API returns PNG, JPEG, WebP, or PDF.
Free tools Windows power users keep installed
One-click scans. No signup required.
Best Value
For a direct screenshot call, see the ScreenshotNeo API documentation:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpScreenshotNeo accepts cookie and consent banners like a visitor and removes more than 60 known consent platforms, newsletter popups, and chat widgets before capture; each step can be turned off. Bot checks or CAPTCHAs, blank pages, timeouts, failed loads, and cache hits cost nothing, and the response identifies the page verdict and billing status in X-Page-Verdict and X-Billed headers. An MCP server provides take_screenshot, get_page_info, and capture_pdf tools for Claude, Cursor, and other MCP clients. The Free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000 shots. Create a free ScreenshotNeo account.
Frequently asked questions
Can I scrape a CSRF-protected site by adding a random header?
No. Only the value, name, session, and request shape validated by that application will work.
Should a CSRF token be sent on GET?
Follow the application contract. CSRF protection is primarily for state-changing requests, while GET should not change state; do not expose tokens in URLs.
Is a CSRF token the same as an API key?
No. A CSRF token supplements a browser-authenticated session. An API key is a separate authentication or authorization credential with its own lifecycle.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
