Cross-site request forgery (CSRF)
CSRF · XSRF · sea surf · session riding · one-click attack · falsification de requête intersite
An attack that makes a logged-in user’s browser silently send a legitimate-looking request (changing an email address, making a transfer, deleting data) to a site where they have an open session.
In practice
Browsers automatically attach session cookies to every request sent to a site. If the application does not check that a request really comes from its own pages, a booby-trapped page visited elsewhere can trigger the action on the user’s behalf. Modern browsers reduce the risk with the SameSite cookie attribute, but that is not enough on its own. In the OWASP Top 10:2025, CSRF falls under Broken Access Control (A01).
Fictional case: an administrator logged into the management console of their firewall opens a booby-trapped article in another tab. The page quietly sends an account-creation request to the console; with no anti-CSRF token, the console accepts it, and the attacker now has admin access.
How to protect yourself
- Unique, unpredictable anti-CSRF tokens on every action that changes data (often built into the framework).
- Session cookies set with SameSite=Lax or Strict.
- Check the Origin or Sec-Fetch-Site headers on the server.
- Ask again for the password or a multi-factor check before sensitive actions.
- Fix XSS flaws, which can be used to get around these protections.
