Cross-Site Request Forgery
By Malcolm McDonald Founder, Editor-in-ChiefAuthor of Grokking Web Application Security
If an attacker can forge HTTP requests to your site, they may be able to trick your users into triggering unintended actions.
- Prevalence
- Common
- Exploitability
- Easy
- Impact
- Harmful
What is cross-site request forgery (CSRF)?
Cross-site request forgery (CSRF) is a request forgery attack in which a malicious website, email or link causes a victim's browser to send a request to a site where the victim is logged in. If the browser attaches the session cookie, the site treats the request as genuine and performs the attacker's chosen action.
What you'll learn
- How a forged cross-site request rides on a logged-in session
- Why state-changing GET requests are dangerous
- How anti-forgery tokens and SameSite cookies stop CSRF
Where this lesson counts
OWASP Top 10
Users act outside their intended permissions, exposing or modifying data they should never reach. Now includes SSRF.
OWASP moved CSRF under Broken Access Control: a forged request is an action the user never authorized.
Learn more about A01PCI DSS v4.0.1
Requirement 6.2.4: engineering techniques must prevent injection, data-structure, cryptographic, business-logic and access-control attacks in bespoke software.
Requirement 6.2.4 names CSRF explicitly under attacks on business logic.
Learn more about 6.2.4This lesson includes
Cross-Site Request Forgery lab
Mal spots that Tweeper creates posts with GET requests. Follow him as he crafts a link, emails it to Vic and turns one forged post into a worm that spreads to every user who clicks it.
How to prevent Cross-Site Request Forgery
The prevention guide covers four approaches, including:
- Keep GET Requests Side-Effect Free
- Use Anti-Forgery Tokens
- Ensure Cookies are sent with the SameSite Cookie Attribute
Cross-Site Request Forgery quiz
Two questions. Passing marks the lesson complete.
Sources
Glossary terms
Related lessons
Browse all 45 lessons
Clickjacking
As an application author, you need to be sure your users aren't having their clicks stolen by attackers.
Cross-Origin Resource Sharing
Overly permissive CORS policies can allow malicious websites to access your APIs and steal user data.
Cross-Site Script Inclusion
If you are putting sensitive data in your JavaScript files, an attacker is probably stealing it.
Cross-Site Scripting
If your site allows users to add content, you need to be sure that attackers cannot inject malicious JavaScript.