CSRF (Cross-Site Request Forgery)

Sitecheck Team

An attack that tricks an authenticated user into unknowingly submitting requests to another site.

CSRF (Cross-Site Request Forgery) is an attack where a malicious website tricks an authenticated user into unknowingly submitting a request to another site — for example, transferring funds or changing account settings — by exploiting the browser's automatic inclusion of session cookies.

Why it matters: CSRF can silently perform destructive actions on behalf of a victim using their existing authenticated session, without them ever knowing.

Quick tips:

  • Use CSRF tokens — unique, unpredictable values attached to forms and validated server-side on each submission.
  • Set cookies with SameSite=Strict or SameSite=Lax to block cross-origin cookie sending in most cases.
  • Validate the Origin or Referer header on all state-changing requests as a secondary check.

See also: XSS, CSP, HTTPS.