Cross-Site Request Forgery (CSRF)
An attack that tricks authenticated users into unknowingly submitting malicious requests to a web application they are logged into.
Cross-site request forgery (CSRF or XSRF) is a web security vulnerability that allows an attacker to induce authenticated users to perform unintended actions on a web application in which they are currently logged in. The attack works by embedding a malicious request — disguised as an image, link, or hidden form — in a page or email that the victim visits. Because the victim's browser automatically includes their session cookies with the request, the target application processes it as a legitimate authenticated action.
CSRF exploits the trust a web application has in an authenticated user's browser. When a user is logged into a banking site and visits a malicious page, that page can contain a hidden form that submits a fund transfer request to the bank. The browser sends the request along with the user's valid session cookie, and the bank processes the transfer because it appears to come from the authenticated user. The victim never sees the request being made. CSRF attacks can target any state-changing operation: changing email addresses, modifying passwords, making purchases, or altering account settings.
Defense against CSRF requires the server to verify that each state-changing request was intentionally made by the user. The standard approach is to include a unique, unpredictable anti-CSRF token in each form and verify it on the server side. Other effective defenses include requiring the SameSite attribute on session cookies, checking the Origin and Referer headers, and requiring re-authentication for sensitive operations. Modern frameworks typically include built-in CSRF protection mechanisms.
CSRF exploits the trust a web application has in an authenticated user's browser. When a user is logged into a banking site and visits a malicious page, that page can contain a hidden form that submits a fund transfer request to the bank. The browser sends the request along with the user's valid session cookie, and the bank processes the transfer because it appears to come from the authenticated user. The victim never sees the request being made. CSRF attacks can target any state-changing operation: changing email addresses, modifying passwords, making purchases, or altering account settings.
Defense against CSRF requires the server to verify that each state-changing request was intentionally made by the user. The standard approach is to include a unique, unpredictable anti-CSRF token in each form and verify it on the server side. Other effective defenses include requiring the SameSite attribute on session cookies, checking the Origin and Referer headers, and requiring re-authentication for sensitive operations. Modern frameworks typically include built-in CSRF protection mechanisms.
Examples
- A hidden image tag on a malicious website triggers a GET request that changes the victim's email address on a vulnerable application.
- A forum post contains an auto-submitting form that transfers money from the victim's bank account when viewed.
- A phishing email contains a link that, when clicked by an authenticated admin, creates a new administrative account on the target system.
Prevention
- Implement anti-CSRF tokens in all state-changing forms and validate them server-side on every request.
- Set the SameSite attribute on session cookies to Lax or Strict to prevent cross-origin cookie sending.
- Verify Origin and Referer headers on state-changing requests as an additional defense layer.
- Require re-authentication or confirmation for sensitive actions like password changes or fund transfers.