Glossary
CROSS-SITE REQUEST FORGERY / CSRF
defined.
An attack that forces a logged-in user’s browser to perform unintended actions on a site where they’re authenticated.
A–Z
An attack that forces a logged-in user’s browser to perform unintended actions on a site where they’re authenticated.
The classic CSRF: a victim visits an attacker’s page, which auto-submits a form to a target site. The browser includes the victim’s session cookie, and the target site happily processes the request.
Defence: SameSite=Lax cookies (default in modern browsers), CSRF tokens for state-changing operations, and double-submit cookie patterns for stateless APIs.
See our web application penetration testing, API security testing, network penetration testing, and cloud security audit services for how we test for and defend against this class of issue.
30-minute call with an OSCP-certified engineer. Tailored proposal in 24 hours.