Rule Definition
When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.

Remediation
Implement CSRF token validation, for example using a known module that provides a CSRF middleware. You can also create a 'csrf_token' session token, send it when creating a form, and check its value on the response sent.

Violation Code Sample

from fastapi import FastAPI

app = FastAPI()

@app.post("/abc")
def func(request: Request, new_password: Annotated[str, Form()]):
    ...

Fixed Code Sample

from fastapi import FastAPI
from starlette_csrf import CSRFMiddleware   # <- protection is present

app = FastAPI()

app.add_middleware(CSRFMiddleware, secret="xxxx")  

@app.post("/abc")
def func(request: Request, new_password: Annotated[str, Form()]):
    ...

CWE-352: Cross-Site Request Forgery (CSRF) https://cwe.mitre.org/data/definitions/352.html OWASP Top 10:2021 - A01:2021 – Broken Access Control https://owasp.org/Top10/A01_2021-Broken_Access_Control/