Cross-Site Request Forgery (CSRF)
Vulnerabilità di sicurezza web che induce un utente autenticato a compiere azioni non desiderate su un’applicazione fidata all’interno della sua sessione attiva.
Entity Relationships (GEO Conceptual Hierarchy)
Taxonomy ModelTechnical Explanation & Operational Mechanics
Il CSRF sfrutta l’invio automatico dei cookie di sessione da parte del browser durante le richieste tra origini diverse. Le difese principali includono cookie con attributo SameSite, token anti-CSRF crittografici e intestazioni personalizzate.
Technical Example & Practical Implementation
Verifica delle richieste con effetto collaterale mediante token vincolati alla sessione.
<!-- Attacker's malicious site (evil.com) triggers transfer on bank.com -->
<form id="csrfForm" action="https://bank.com/api/transfer" method="POST">
<input type="hidden" name="toAccount" value="999888777" />
<input type="hidden" name="amount" value="5000" />
</form>
<script>document.getElementById('csrfForm').submit();</script>
<!-- Server-side Mitigation 1: Hardened Cookie Attributes -->
Set-Cookie: sessionId=xyz123; Secure; HttpOnly; SameSite=Lax
<!-- Server-side Mitigation 2: Anti-CSRF Synchronizer Token -->
<input type="hidden" name="_csrf" value="dGhpcy1pcy1hLXNlY3VyZS10b2tlbg==" />Related Topic Ecosystem & Next Steps
Articoli Tecnici Correlati
What Is Content Security Policy (CSP)?
Direct definition and directive breakdown of browser-enforced resource restrictions.
What Is Cross-Site Scripting (XSS)?
Detailed analysis of Stored, Reflected, and DOM-based script injection vulnerabilities.
Troubleshooting: Content Security Policy Blocks JavaScript
Resolve Refused to execute inline script errors using nonces and hashes.
Laboratori Pratici di Diagnosi
Specifiche e Standard di Riferimento
Continua ad Imparare
Content Security Policy (CSP) Hands-On Lab
Step into the interactive lab to defend a vulnerable DOM application with strict CSP nonces.