thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Cross-Site Request Forgery (CSRF)

An attack that tricks an authenticated user's browser into sending unwanted requests to a site where they are logged in.

Definition

Because browsers automatically include cookies, a malicious page can submit forms or requests to a target site using the victim's session. Anti-CSRF tokens, SameSite cookie attributes and re-authentication for sensitive actions mitigate it.

Example

An image tag on a forum loading https://bank.example/transfer?to=attacker&amt=1000.

Exam tip

CSRF exploits the site's trust in the user's browser; XSS exploits the user's trust in the site.

Don't confuse it with

Related terms