What is Cross Site Request Forgery (CSRF) and How It Works

Cross Site Request Forgery (CSRF) is a security attack where a malicious website tricks a user's browser into making unwanted actions on another site where the user is logged in. It exploits the trust a site has in the user's browser by sending unauthorized commands without the user's consent.

How It Works

Imagine you are logged into your online bank account in one browser tab. Meanwhile, you visit a malicious website in another tab. This bad site secretly sends a request to your bank to transfer money, using your logged-in session without your knowledge. This is how CSRF works: it tricks your browser into sending commands to a trusted site because your browser automatically includes your login details like cookies.

In simple terms, CSRF attacks take advantage of the fact that browsers remember your login status and send it with every request. The attacker creates a fake request that looks normal to the trusted site, so the site performs the action thinking it is you. This can cause unwanted changes like changing your password, making purchases, or deleting data.

Example

This example shows a simple HTML form that an attacker might use to trick a user’s browser into sending a money transfer request to a bank website without the user’s consent.

html

<form action="https://bank.example.com/transfer" method="POST" style="display:none;" id="csrfForm">
  <input type="hidden" name="amount" value="1000">
  <input type="hidden" name="to_account" value="attacker123">
</form>
<script>
  document.getElementById('csrfForm').submit();
</script>

Output

The form automatically submits a POST request to https://bank.example.com/transfer transferring 1000 units to attacker123 without user interaction.

When to Use

Understanding CSRF is crucial for web developers and security teams to protect websites that rely on user sessions. You should implement protections against CSRF whenever your site allows users to perform actions like changing settings, making payments, or submitting forms.

Real-world use cases include online banking, shopping sites, social media platforms, and any web application where users are logged in and can change data. Protecting against CSRF helps prevent attackers from abusing user trust and causing harm.

Key Points

• CSRF tricks a logged-in user’s browser into sending unwanted requests.
• It exploits the browser’s automatic inclusion of login cookies.
• Attackers create hidden forms or links that submit actions without user consent.
• Protection methods include using tokens, checking request origins, and requiring user interaction.

Key Takeaways

CSRF attacks exploit the trust between a user’s browser and a website by sending unauthorized requests.

Always protect sensitive actions on your website with CSRF tokens or similar safeguards.

CSRF can cause serious harm like unauthorized money transfers or data changes if not prevented.

User login sessions and cookies are the main targets exploited by CSRF attacks.

Implementing CSRF protection is essential for any site that handles user data or transactions.