CSRF (Cross-Site Request Forgery)

CSRF (cross-site request forgery) is an attack in which a malicious page causes a victim's browser to send a state-changing request, such as changing an email or transferring funds, to a site where the victim is already logged in.

Why it matters

The browser automatically attaches cookies to requests, so the target site cannot tell the request was not intentional. Defenses include anti-CSRF tokens, SameSite cookies, checking the Origin header and requiring re-authentication for sensitive actions. It is different from XSS, which runs script inside the target site.

Example

A hidden form on a malicious page posts to https://bank.example/change-email. If the bank relies only on the session cookie, it processes the request. With a per-session token required in the form, the forged request is rejected.

Common mistakes

• Using GET requests for actions that change data.
• Assuming CORS settings alone prevent CSRF.
• Not setting SameSite on session cookies.

Related

• XSS
• CORS
• Session hijacking
• OAuth
• टूल: Cookie checker

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.