title: What Response Should Be Sent Back a When Cross-Site Request Forgery (CSRF) is Detected
body: <p>What response should I send back when a Cross-Site Request Forgery (CSRF) is detected?</p>
  
  <p>There is a scanning tool which I cannot get a hold of that is saying one of my pages is not protected against <code>CSRF</code>.  But it is.  The response I send back is a normal <code>202</code> with the sentence "REQUEST CANNOT BE PROCESSED".  That's it, nothing informative is sent back to the attacker, and I log the attempt.  But this software says it is still susceptible to <code>CSRF</code>.  I could easily run tests myself and figure it out but it's a long time in between scans and tests and I can't get the same software, that's why I'm asking stackoverflow, so I can hopefully knock it out on the next scheduled scan.  I'm thinking of sending back a statusCode of <code>404</code> or <code>410</code> instead of a <code>202</code>.  <strong><a href="http://www.cfgears.com/index.cfm/2009/8/11/cfheader-404-status-codes-and-why-you-shouldnt-use-them" rel="noreferrer">http://www.cfgears.com/index.cfm/2009/8/11/cfheader-404-status-codes-and-why-you-shouldnt-use-them</a></strong></p>
  
  <p>What do you recommend sending back when a <code>CSRF</code> is detected?</p>