Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) is a web vulnerability that tricks an authenticated user's browser into sending an unwanted state-changing request to a site where they are logged in, letting an attacker perform actions as that user without knowing their credentials.
Cross-Site Request Forgery (CSRF) abuses the fact that browsers automatically attach a user's session cookies to every request sent to a site. If an attacker can get a victim to load a malicious page or link while they are authenticated, that page can silently submit a form or fire a request to the target application, and the server will treat it as a legitimate, authenticated action such as changing an email address, transferring funds, or updating settings.
The attack works because the vulnerable server verifies who the user is (via the ambient cookie) but not that the request was intentionally initiated from its own pages. The standard defense is an anti-CSRF token: a per-session or per-request secret embedded in forms and validated on the server, which the attacker's cross-origin page cannot read or guess. Modern mitigations also include the SameSite cookie attribute, verifying Origin/Referer headers, and requiring re-authentication for sensitive operations.
For developers, CSRF matters because it targets authenticated actions and needs no XSS or credential theft to succeed — a single unprotected state-changing endpoint is enough. It appears on the OWASP radar (historically its own Top 10 category, now folded under broken access control) and is cataloged as CWE-352. Framework-level CSRF protection should be enabled by default and never disabled on endpoints that change server state.