Cross-site request forgery (CSRF) in Cybersecurity - Full Explanation

Introduction

Imagine you are logged into your bank website and then visit another website that tricks your browser into sending a money transfer request without your knowledge. This problem happens because websites trust your browser too much. Cross-site request forgery (CSRF) is the attack that exploits this trust to perform unwanted actions on your behalf.

Explanation

How CSRF Works

CSRF tricks your browser into sending a request to a trusted website where you are already logged in. The attacker creates a fake request that looks normal to the website, so it processes the action as if you made it. This happens because browsers automatically include your login information like cookies with every request.

CSRF exploits the trust a website has in your browser by sending unauthorized requests using your credentials.

Why CSRF is Dangerous

CSRF can cause serious problems like changing your password, transferring money, or posting unwanted messages without your permission. Since the website thinks the request is from you, it performs the action immediately. This can lead to loss of money, data, or control over your account.

CSRF attacks can make websites perform harmful actions without the user's consent.

Common CSRF Protection Methods

Websites use special tokens called CSRF tokens that are unique for each user session and included in forms or requests. When a request comes in, the website checks if the token matches what it expects. If it doesn't, the request is rejected. This stops attackers because they cannot guess or send the correct token.

CSRF tokens help websites verify that requests come from the legitimate user and not an attacker.

Role of SameSite Cookies

SameSite cookies are a browser feature that restricts cookies from being sent with cross-site requests. Setting cookies to SameSite helps prevent CSRF by stopping the browser from including cookies when requests come from other websites. This reduces the chance that an attacker can use your login cookies in a forged request.

SameSite cookies limit cookie sharing across sites, reducing CSRF risks.

Real World Analogy

Imagine you have a trusted assistant who always follows your instructions. One day, a stranger sneaks in and whispers a fake order to your assistant, who then carries it out thinking it came from you. You never gave that order, but the assistant trusted the stranger because they looked like you.

How CSRF Works → The stranger whispering fake orders to your trusted assistant

Why CSRF is Dangerous → The assistant doing harmful tasks you never asked for

Common CSRF Protection Methods → Giving your assistant a secret code word that only you know to confirm orders

Role of SameSite Cookies → Making sure your assistant only listens to you when you are in the same room

Diagram

Diagram

┌───────────────┐       ┌───────────────┐       ┌───────────────┐
│   User's      │       │  Attacker's   │       │  Trusted      │
│  Browser      │──────▶│  Website      │       │  Website      │
│ (Logged in)   │       │ (Malicious)   │       │ (Bank, etc.)  │
└───────────────┘       └───────────────┘       └───────────────┘
        │                      │                      ▲          
        │                      │                      │          
        │                      └───────────────┐      │          
        │                                      │      │          
        └───────────────Forged Request────────┘      │          
                                                   │          
                                        Accepts request as if from user

This diagram shows how the user's browser is tricked by the attacker's website into sending a forged request to the trusted website.

Key Facts

CSRF → An attack that tricks a user's browser into sending unauthorized requests to a trusted website.

CSRF Token → A secret value included in requests to verify they come from the legitimate user.

SameSite Cookie → A cookie setting that restricts cookies from being sent with cross-site requests.

Cookie → Data stored by the browser that helps websites remember who you are.

Common Confusions

CSRF is the same as Cross-site scripting (XSS).

CSRF is the same as Cross-site scripting (XSS). CSRF tricks your browser to send unwanted requests, while XSS injects malicious code into websites to steal data or control the page.

Logging out prevents CSRF attacks.

Logging out prevents CSRF attacks. CSRF attacks require you to be logged in; logging out stops them, but while logged in, protection methods like CSRF tokens are needed.

Summary

CSRF tricks your browser into sending harmful requests to websites where you are logged in without your permission.

Websites protect against CSRF by using secret tokens and cookie settings that verify requests are genuine.

Understanding CSRF helps you recognize why websites ask for extra confirmation before sensitive actions.