CSRF
acronymweb devsecurity
Stands for: Cross-Site Request Forgery
An attack that tricks a logged-in user's browser into making an unwanted request.
Cross-Site Request Forgery abuses the fact that browsers attach cookies automatically: a malicious page can cause your authenticated browser to perform an action you did not intend. Anti-CSRF tokens and same-site cookies are the usual defences.
Cross-site request forgery makes a victim's browser send an authenticated request the victim did not intend, exploiting the fact that cookies are attached to a request automatically regardless of what caused it. The attacker cannot read the response, which is why CSRF is about actions rather than data theft: transfers, password changes, permission grants.
Anti-forgery tokens work because they require something the attacker cannot obtain from a third-party page, and the SameSite cookie attribute closes most of the class by default in modern browsers. The trap is treating that default as complete: SameSite=Lax still permits top-level navigations, cross-origin API endpoints authenticated by cookie remain exposed, and any endpoint that performs a state change on GET is vulnerable regardless of what the cookie policy says.
Also known as: csrf, xsrf, cross-site request forgery, sea-surf