Glossary

CSRF

CSRF (Cross-Site Request Forgery) is an attack that tricks an authenticated user's browser into sending a forged request to a server on their behalf. The browser automatically includes cookies — so the server considers the request legitimate.

How it happens

The victim is logged into bank.com. They open a malicious page with a hidden <form> that auto-submits a POST to bank.com/transfer. The browser attaches the bank's cookie — and the transfer goes through.

Defence

CSRF token — the server generates a unique, unpredictable token and embeds it in a hidden form field (<input type="hidden" name="_token" value="...">). On submission, the server compares the token against the one stored in the session
SameSite cookie — the SameSite=Lax/Strict attribute prevents the browser from sending cookies in cross-site requests. The most effective modern defence
Stateless APIs using Bearer tokens in headers are not vulnerable to CSRF