Cross-Site Request Forgery (CSRF)
CSRF forces an authenticated user to submit unwanted requests to a web application. By exploiting the trust a site has in a user's browser, attackers can perform state-changing operations without the user's knowledge or consent.
Overview
Cross-Site Request Forgery (CSRF/XSRF) is an attack that forces an authenticated user to execute unwanted actions on a web application. If the victim is authenticated, the browser automatically includes their session cookies with every request to the target site. Attackers exploit this by crafting malicious pages, emails, or links that trigger state-changing requests.
Types & Variants
GET-Based CSRF
Exploiting state-changing GET requests through image tags, iframes, or link clicks.
POST-Based CSRF
Using auto-submitting forms embedded in malicious pages.
Impact
Unauthorized actions (fund transfers, email changes, password resets), account modification, data manipulation on behalf of the victim.
Examples
Auto-Submit Form
<form action="https://bank.com/transfer" method="POST"><input type="hidden" name="to" value="attacker"><input type="hidden" name="amount" value="10000"><script>document.forms[0].submit();</script></form>
Remediation
Implement anti-CSRF tokens, use SameSite cookie attribute, verify Origin and Referer headers, require re-authentication for sensitive actions.
Implement synchronizer token pattern (anti-CSRF tokens)
Set SameSite=Strict or SameSite=Lax on all cookies
Verify Origin and Referer headers on state-changing requests
Require re-authentication for sensitive operations
Related SuperClue scanner checks
These scanner checks look for signs of Cross-Site Request Forgery (CSRF). What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works