What is Cross-Site Request Forgery (CSRF)? Cross-Site Request Forgery · CSRF

How CSRF Works#

Because browsers automatically attach session cookies to cross-origin requests, a malicious webpage can trigger hidden state-changing requests against vulnerable endpoints.

Everyday Analogy#

A fraudster tricking a busy customer into unknowingly signing a pre-filled bank check while they are already verified at the teller window.

Practical Applications#

• Enforcing CSRF tokens (nonces) across all state-changing HTML forms
• Setting SameSite=Lax/Strict cookie attributes on authentication tokens