protect against CSFR attack