Cross-Site Request Forgery

Cross-Site Request Forgery (CSRF or XSRF)is a web security vulnerability that tricks an authenticated user into executing unwanted, state-changing actions—such as changing passwords, transferring funds, or updating email addresses—on a trusted website without their consent. It exploits the browser's automatic inclusion of credentials (cookies) in requests.

Key Aspects of CSRF:

• Mechanism:An attacker tricks a victim into visiting a malicious site or clicking a link, which triggers an HTTP request to a vulnerable application where the user is already logged in.
• Target: Focuses on state-changing requests (POST, PUT, DELETE) rather than data theft, as the attacker does not receive the response.
• Examples: Forcing a user to click a link that transfers money, changes account email, or updates credentials.

Prevention Strategies:

• Anti-CSRF Tokens:Implement unique, secret, and unpredictable tokens for each request (or session) that the server validates.
• SameSite Cookie Attribute: Configure cookies to SameSite=Strict or SameSite=Lax to prevent browsers from sending them with cross-site requests.
• Double Submit Cookies: Send a random value in both a cookie and a request parameter, ensuring they match.
• Custom Request Headers: Using AJAX or APIs to require custom headers that cannot be set across origins.

CSRF differs from Cross-Site Scripting (XSS) in that XSS exploits the trust a user has in a site, while CSRF exploits the trust a site has in a user's browser.