CSRF explained
How cross-site request forgery works and how to stop it: why browsers attach cookies to cross-site requests, a concrete attack, SameSite cookies, CSRF tokens and the synchronizer and double-submit patterns, Origin checks, framework defaults in Spring, Django and Express, and when token-based APIs are not affected.
CodexBash, , 6 min read
You are signed in to your bank in one tab. In another tab you open a harmless-looking page, and without a click, money moves out of your account. That is cross-site request forgery (CSRF): a malicious site makes your browser send a request to a site where you are logged in, and because the browser automatically attaches your cookies, the target site believes you sent it. CSRF was one of the most common web vulnerabilities for years. Modern browser defaults have made it rarer, but not impossible, and every developer using cookie-based sessions should understand the defences. This article explains the attack and each protection.
Sign in to read the rest
The whole 6 minute article is free with an account, along with every problem, lesson and tutorial. No card.