CSRF (Cross Site Request Forgery)

👉 Overview

👀 What ?

Cross-Site Request Forgery (CSRF) is a type of attack that tricks the victim into submitting a malicious request. It infiltrates a victim's browser and forces it to make an unwanted request to a web application in which they're authenticated.

🧐 Why ?

Understanding CSRF is crucial as it can lead to unwanted actions on a web application to which the victim has authenticated access. These actions can include changing email address, home address, or even password, leading to severe privacy breaches.

⛏️ How ?

CSRF attacks can be prevented by implementing anti-CSRF tokens in web applications. These tokens are added to forms and AJAX calls within the site and verified on the server side. This ensures that requests made are legitimate and not part of a CSRF attack.

⏳ When ?

CSRF attacks have been prevalent since the early 2000s and continue to be a significant risk due to the increasing sophistication of attack methods.

⚙️ Technical Explanations

At its core, CSRF exploits the trust that a web application has in a user's browser. The attack works by including a link or script in a page that accesses a site to which the user is authenticated. For instance, suppose the victim has an active session with a site and the site does not check for a valid CSRF token in the request. In that case, the attacker can trick the victim's browser into making a request to the site on their behalf, leading to potential data loss or alteration.