Cross-Site Request Forgery (CSRF)
An attack that tricks an authenticated user's browser into transmitting unauthorized state-changing HTTP requests to a vulnerable application using the victim's active session cookies.
Entity Relationships (GEO Conceptual Hierarchy)
Taxonomy ModelTechnical Explanation & Operational Mechanics
Cross-Site Request Forgery exploits the browser's default behavior of automatically attaching stored cookies (including session IDs and authentication cookies) to outgoing cross-origin HTTP requests. If a victim is logged into bank.com and visits attacker.com, the malicious page can submit a hidden HTML form pointing to bank.com/transfer. Because the browser automatically attaches the user's bank.com cookies, the server processes the transfer as authentic. Modern defenses include the SameSite cookie attribute (Strict or Lax), custom anti-CSRF tokens validated in request headers, and checking origin headers.
Technical Example & Practical Implementation
How malicious sites trigger ambient cookie submission and how modern headers stop it
<!-- Attacker's malicious site (evil.com) triggers transfer on bank.com -->
<form id="csrfForm" action="https://bank.com/api/transfer" method="POST">
<input type="hidden" name="toAccount" value="999888777" />
<input type="hidden" name="amount" value="5000" />
</form>
<script>document.getElementById('csrfForm').submit();</script>
<!-- Server-side Mitigation 1: Hardened Cookie Attributes -->
Set-Cookie: sessionId=xyz123; Secure; HttpOnly; SameSite=Lax
<!-- Server-side Mitigation 2: Anti-CSRF Synchronizer Token -->
<input type="hidden" name="_csrf" value="dGhpcy1pcy1hLXNlY3VyZS10b2tlbg==" />Related Topic Ecosystem & Next Steps
Related Technical Articles
What Is Content Security Policy (CSP)?
Direct definition and directive breakdown of browser-enforced resource restrictions.
What Is Cross-Site Scripting (XSS)?
Detailed analysis of Stored, Reflected, and DOM-based script injection vulnerabilities.
Troubleshooting: Content Security Policy Blocks JavaScript
Resolve Refused to execute inline script errors using nonces and hashes.
Hands-On Diagnostic Labs
Developer References & Specifications
Continue Learning
Content Security Policy (CSP) Hands-On Lab
Step into the interactive lab to defend a vulnerable DOM application with strict CSP nonces.