CSRF (Cross-Site Request Forgery)
Sitecheck Team
An attack that tricks an authenticated user into unknowingly submitting requests to another site.
CSRF (Cross-Site Request Forgery) is an attack where a malicious website tricks an authenticated user into unknowingly submitting a request to another site — for example, transferring funds or changing account settings — by exploiting the browser's automatic inclusion of session cookies.
Why it matters: CSRF can silently perform destructive actions on behalf of a victim using their existing authenticated session, without them ever knowing.
Quick tips:
- Use CSRF tokens — unique, unpredictable values attached to forms and validated server-side on each submission.
- Set cookies with
SameSite=StrictorSameSite=Laxto block cross-origin cookie sending in most cases. - Validate the
OriginorRefererheader on all state-changing requests as a secondary check.