CSRF (Cross-Site Request Forgery)
An attack that forces authenticated users to execute unwanted actions on a web application by tricking them into clicking malicious links or submitting forms.
Definition
CSRF exploits the trust a web application has in the user's browser. When a user is logged into a site, their session cookies are automatically sent with every request. Attackers craft malicious pages that make requests to the target site, executing actions as the authenticated user. Modern defenses include CSRF tokens, SameSite cookies, and origin checking. Unlike XSS, CSRF doesn't inject code — it leverages existing sessions.
Why It Matters
CSRF is listed in OWASP Top 10 and has affected major sites including YouTube and Netflix. Without protection, attackers can change passwords, transfer funds, or modify user data. Modern frameworks (Rails, Django, Next.js) include built-in CSRF protection, but developers must understand and enable it correctly.
Example
A user is logged into their bank. They visit a malicious site with a hidden form that POSTs a money transfer request to the bank's API. Because the user's session cookie is sent automatically, the bank processes the transfer as if the user initiated it.