Cross-Site Request Forgery

Description

If it is enough for the web application that the request arrives with a valid session, the attacker can carry out an action the user never intended. A change of mail address, password, account settings, an order or a transfer of funds can be set off from another page, through a hidden form, an image or a script.

CSRF is an attack on the trust the application places in the user's browser. The user may be entirely unaware that the request happened. Sensitive actions therefore need an additional check of intent, not just a valid session.

Examples

• The user is logged into an administrative panel and then opens another page that automatically sends a request to change a setting.
• A hidden form on a malicious page sends a request to change the mail address on the victim's account.
• A link in a message triggers an action on a site where the user is already logged in, with no clear warning and no confirmation.

Notes

• CSRF does not necessarily steal data. It is enough that it makes the web application do something malicious in the user's name.
• Anti-CSRF tokens, SameSite cookies and checking the Origin or Referer header are not decoration but proof that the request came from the expected flow of the application.