CSRF

Cross-Site Request Forgery (CSRF) is a web security vulnerability in which an attacker tricks a user’s browser into submitting a request to a web application in which the user is authenticated. The forged request can perform state-changing actions, such as transferring funds or changing account settings, by exploiting the browser’s automatic inclusion of credentials like cookies.

CSRF works by leveraging the fact that browsers automatically send cookies with requests to a target site, including cross-origin requests. An attacker-hosted page can cause the user’s browser to issue a request to the target site, and the server will treat it as if the user intended to perform the action. The attacker cannot typically read the response, due to the same-origin policy, but the action still occurs under the victim’s session.

Common examples include a malicious page submitting a form to transfer money, change an email address, or alter account settings on a legitimate site from which the user is logged in. The attack relies on the user’s authenticated session and the server’s trust in the request’s origin.

Defenses against CSRF include several complementary approaches. The SameSite cookie attribute can prevent most cross-site requests from carrying credentials. Anti-CSRF tokens, unique per user and validated on state-changing requests, are widely used. The double-submit cookie pattern, origin or Referer header validation, and requiring explicit user action or re-authentication for sensitive operations also help. Designing APIs to rely on tokens included in headers rather than cookies reduces CSRF risk.

CSRF is distinct from Cross-Site Scripting (XSS); CSRF abuses legitimate credentials, while XSS exploits injected scripts to access data.