Krysspartisjonsforespørsler

Krysspartisjonsforespørsler, often abbreviated as CSRF, is a type of web security vulnerability that allows an attacker to trick a user's web browser into executing unwanted actions on a web application in which the user is currently authenticated. This can happen when a user visits a malicious website or clicks on a malicious link, and the attacker's code is then sent to the vulnerable web application. The application, mistaking the request as originating from the authenticated user, performs the action. Examples of such actions could include changing an email address, transferring funds, or making a purchase.

CSRF attacks exploit the trust a web application has in the user's browser. When a user logs into a website, their browser stores authentication tokens, such as cookies. Subsequent requests from that browser to the same website are automatically sent with these tokens, confirming the user's identity. An attacker crafts a request that leverages these automatically sent tokens to perform an action without the user's explicit consent or knowledge.

Preventing CSRF attacks involves implementing various security measures. One common method is the use of anti-CSRF tokens. These are unique, secret, and unpredictable tokens that are generated by the server and embedded in HTML forms. When the form is submitted, the token is sent back to the server. The server then verifies that the token is valid and matches the one it generated. If the tokens don't match, the request is considered suspicious and is rejected. Other defenses include checking the HTTP Referer header, using custom request headers, and implementing SameSite cookie attributes.