A8: Cross-Site Request Forgery (CSRF) · 2013

An authenticated person's browser can be induced to send an unwanted action to an application that trusts only its cookies.

Summary

An authenticated person's browser can be induced to send an unwanted action to an application that trusts only its cookies.

How the attack works

A form on another site submits an action with the victim’s cookies; the server does not verify that the request is intentional.

Example

Vulnerable · Pseudocode

POST /account/email
Cookie: session=alice
email=new@example.test
csrf_token=missing

Fix: Validate a session-bound anti-CSRF token; use SameSite and origin checks as additional defenses.

Prevention

Use session-bound anti-CSRF tokens.
Configure SameSite cookies and check the origin where appropriate.
Require reauthentication or confirmation for sensitive actions.

Lineage

2013 · A8: Cross-Site Request Forgery (CSRF) Leaves the Top 10 in 2017

Sources

Open official source ↗

Buy me a coffee