CSRF Explained

CSRF, cross site request forgery, tricks a logged in user's browser into making a request they did not intend, using their existing session. The classic defence is a synchroniser token the attacker cannot know, and SameSite cookies now remove the primary delivery mechanism for many CSRF variants. Checking the Referer header is not a reliable defence.

How CSRF works

You are logged into your bank. You visit a malicious page in another tab. That page silently submits a form to your bank's transfer endpoint. Your browser attaches your bank session cookie automatically, so the bank sees a legitimate authenticated request. The transfer happens without your intent.

Why the browser cooperates

Browsers attach cookies for a site to every request to that site, regardless of which page triggered it. That automatic behaviour is what CSRF abuses. The attacker never sees your cookie; they just cause your browser to use it.

A real attack, dissected

<form action="https://bank.com/transfer" method="POST" id="x">
  <input name="to" value="attacker">
  <input name="amount" value="10000">
</form>
<script>document.getElementById('x').submit()</script>

Placed on a page the victim visits while logged into the bank, this submits automatically. No click needed.

The defences that work

SameSite, the modern default

SameSite cookie attributes tell the browser not to send a cookie on cross site requests. With SameSite set to Lax or Strict, the malicious page's request arrives without the session cookie, and the attack fails. Modern browsers default to Lax, which has quietly killed a large share of classic CSRF.

What does not work

• Checking the Referer header, which can be missing or stripped
• Using POST instead of GET, forms can POST cross site
• Obscure parameter names, trivially discovered

CSRF vs XSS

Often confused. CSRF makes the victim's browser send a request. XSS runs attacker script in the victim's browser, which is more powerful and can defeat CSRF tokens. See XSS explained.

Practise this

Build and defeat a CSRF on a lab app to understand it properly. Free labs on Hacklido.