Skip to content
uencoder

CSRF

CSRF (cross-site request forgery) is a vulnerability where the attacker tricks a logged-in user into unknowingly sending a malicious request to the target site.

Purpose

To prevent attackers from borrowing the victim session to perform unauthorized operations.

Mechanism

The attacker hosts a malicious page containing <form> or <img> that sends a request to the target site. The browser attaches cookies automatically, and the server mistakes it for the user. Defenses: CSRF tokens (synchronizer tokens), SameSite cookies, checking Origin/Referer headers.

Use cases

  • Forged bank transfers
  • Changing account settings
  • Posting content or comments
  • Data deletion operations

Examples

  • Input 
    <form action="bank.com/transfer" method="POST">
    Output 
    Transfer initiated riding on cookies

    Cross-site forgery

Common errors

Relying solely on cookie authentication without a CSRF token
Add a CSRF token or SameSite=Strict

Related terms

XSS
XSS (cross-site scripting) is attackers injecting malicious scripts into a page that execute in other users browsers; it comes in stored, reflected, and DOM-based forms.
GLOSSARY
Cookie
A cookie is a key-value pair set by the server and stored by the browser, sent automatically with same-origin requests for session and state management.
GLOSSARY
SameSite Cookie
The SameSite cookie attribute (Strict/Lax/None) controls whether the browser sends cookies in cross-site requests, defending against CSRF.
GLOSSARY
SQL Injection
SQL injection is attackers splicing malicious SQL fragments into a query string so the database executes unintended commands.
GLOSSARY

References