Cross-site request forgery (CSRF) is a web attack where a user’s browser is tricked into sending a valid, state-changing request to a site where the user is already signed in, for example submitting a form on bank.example after the user clicks a hidden link on attacker.example. Because browsers automatically attach cookies for the real site, the target sees the request as if it came from the user. Typical victims are actions like changing an email address, transferring money, or adding an admin user. CSRF needs three things to line up: the user must be authenticated to the target, the action must be possible with a one-click request such as a GET or POST, and the site must not strongly verify that the request came from its own pages. Common defences include a unique anti-CSRF token that the site places in each form and checks on submission, the SameSite cookie attribute which limits when cookies are sent with cross-site requests, strict checks on the Origin or Referer header, and requiring re-authentication for sensitive changes. CSRF is different from XSS. CSRF makes the browser send a forged request without running code on the target site, while XSS runs attacker script inside the target’s pages.
