Cross-site Request Forgery (CSRF)
- •
def
- •
an attack (also called a one-click attack or session riding) that takes advantage of a web application's trust in an already-authenticated user's browser, submitting requests the user never intended to make
- •
- •
example
- •
an attacker crafts a hyperlink that, when clicked by a user already logged into their bank, silently submits a funds-transfer request on their behalf
- •
- •
mitigation
- •
the application should include anti-forgery techniques, typically a cryptographic token that verifies the request was intentional
- •
- •
related
- •