CSRF Attacks

CSRF attacks trick an already-logged-in user's browser into unknowingly submitting a malicious request to a site they're authenticated on.

How CSRF Exploits Trust

Because the victim's browser automatically includes their session cookies, a malicious request crafted by an attacker can appear completely legitimate to the target website.

A Typical CSRF Scenario

A victim logged into their bank account visits a malicious page that silently submits a funds transfer request, which the bank's server processes because it appears to come from an authenticated session.

Why CSRF is Dangerous

Since the request rides on the victim's own valid session, CSRF can bypass authentication entirely, making it especially dangerous for actions like changing passwords or making payments.

Preventing CSRF

Anti-CSRF tokens, checking the request's origin, and using the SameSite cookie attribute are the standard defenses that ensure requests genuinely originate from the intended site.