CSRF (Cross-Site Request Forgery) is a vulnerability where an attacker tricks a victim’s browser into sending a state-changing request to a site the victim is logged into. The action runs with the victim’s session without their intent: changing a password, transferring funds, or updating an email. It works because browsers automatically attach cookies. The standard fix is an anti-CSRF token the attacker cannot guess, reinforced by SameSite cookies.
What CSRF is
When a user is logged into a site, their browser automatically sends the session cookie with every request to that site, including requests triggered by another site. That automatic attachment is the root of CSRF.
An attacker builds a page that quietly submits a request to the target site (a form post, an image tag, JavaScript). When the logged-in victim visits it, their browser sends the request with their cookies, and the target site, seeing a valid session, performs the action as if the user meant it.
How it works and example
The attacker hosts a page that auto-submits a request to the target:
- A hidden auto-submitting form posts to
https://bank.example/transferwith the attacker’s account as the recipient. - An
<img src="https://app.example/account/delete">fires a GET-based state change. - When the authenticated victim loads the attacker’s page, the request runs as them.
CSRF needs the action to rely on cookies alone and to lack an unpredictable token. It does not let the attacker read the response, only cause the action. Examples shown for defensive context.
How to fix it
- Use anti-CSRF tokens on every state-changing request (synchronizer token or double-submit), validated server-side.
- Set `SameSite=Lax` or `Strict` on session cookies so they are not sent on cross-site requests.
- Require re-authentication or a token for sensitive actions.
- Do not make GET requests state-changing.
- Check Origin/Referer as a supporting control, and test forms for missing token validation.
References
- [1]OWASP: CSRF Prevention(OWASP)
- [2]MITRE CWE-352: Cross-Site Request Forgery(MITRE CWE)
- [3]OWASP Top 10(OWASP)