thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Application & OT Security

CSRF vs SSRF: What's the Difference?

CSRF makes a victim's browser send an unwanted request to a site where they are logged in. SSRF makes a vulnerable server send requests on the attacker's behalf, often to internal systems or cloud metadata endpoints the attacker could not reach directly.

Cross-Site Request Forgery (CSRF)

Full definition
vs

Server-Side Request Forgery (SSRF)

Full definition
Cross-Site Request ForgeryServer-Side Request Forgery
Who sends the forged requestVictim's browserThe vulnerable server
TargetWeb application where the user is authenticatedInternal services, cloud metadata (169.254.169.254), localhost
Requires a victim user?YesNo
Typical impactUnwanted actions in the user's accountInternal network scanning, credential theft from metadata
DefenseAnti-CSRF tokens, SameSite cookiesURL allow-lists, block internal ranges, IMDSv2, egress filtering
Remember it

CSRF abuses the client; SSRF abuses the server.

Exam tip

Any mention of the cloud metadata IP 169.254.169.254 or a URL parameter that fetches remote content points to SSRF.

Tested on

More Application & OT Security look-alikes