Cross-site request forgery is an attack that tricks a browser into sending an unwanted state-changing request while the user is already signed in.
CSRF is a web attack in which an attacker causes a victim's browser to send a request to a trusted site without the victim intentionally taking that action.
The browser may automatically include the victim's session cookie, so the server can mistake the forged request for a real one.
Think of CSRF like someone hiding a signed form inside an envelope that you unknowingly mail to your bank.
The bank sees your valid signature and processes the form, even though you did not mean to request the transfer.
A CSRF defense adds a second proof that the request came from the real site and the real action.
CSRF defenses help the server distinguish an intentional request from a cross-site request made by a browser.
Check that a request came from an allowed site or origin.
Match a secret, unpredictable value supplied by the application.
Defend actions such as password changes, transfers, and updates.
Stop requests that fail the required validation checks.
CSRF protection matters when a browser uses ambient credentials, especially cookies, for authenticated requests.
Changing an email address, password, or profile setting.
Submitting a purchase, transfer, or billing action.
Creating users, changing roles, or deleting records.
Any state-changing endpoint that trusts a browser session cookie.
<form action="https://bank.example/transfer" method="POST"> <input name="amount" value="1000"> <input name="to" value="attacker"> </form>
If the victim is signed in to the bank, a malicious page may cause the browser to submit a request to the bank. The bank should require a valid CSRF token or equivalent protection before accepting the transfer.
The dangerous part is the combination of an unwanted cross-site action and credentials that the browser sends automatically.
The browser carries the session credential, while the server verifies a CSRF token, origin, or an appropriate cookie policy before changing state.
Tricks a browser into sending an authenticated request that the user did not intend.
Injects or executes untrusted script in a trusted page or application context.
Controls whether browser scripts may read cross-origin responses; it is not a general CSRF defense.
CSRF is about unwanted actions. XSS is about script execution. CORS is about browser read access across origins.
| ENGLISH TERM | 中文 | SIMPLE ENGLISH | 中文小白理解 |
|---|---|---|---|
| CSRF | 跨站请求伪造 | An attack that causes a browser to send an unwanted request to a trusted site. | 诱导浏览器向可信网站发送用户并不想发出的请求。 |
| CSRF Token | CSRF 令牌 | An unpredictable value used to prove that a request came from the trusted application. | 用来证明请求来自可信应用的一段难以猜测的值。 |
| Origin | 来源 | The combination of scheme, host, and port that identifies a web origin. | 由协议、主机和端口共同组成的网站来源标识。 |
| Session Cookie | 会话 Cookie | A browser cookie that helps a server recognize a signed-in session. | 帮助服务器识别登录会话的浏览器 Cookie。 |
| State-Changing Request | 改变状态的请求 | A request that creates, updates, or deletes data or performs an action. | 会新增、修改、删除数据或执行某个动作的请求。 |
| SameSite | 同站策略 | A cookie setting that controls when a cookie is sent in cross-site contexts. | 控制 Cookie 在跨站场景下何时发送的设置。 |
| Ambient Credential | 自动携带的凭证 | A credential that the browser sends automatically with a matching request. | 浏览器遇到匹配请求时会自动带上的凭证。 |
CSRF abuses credentials that a browser sends automatically to make a trusted site accept an unwanted action.
Protect state-changing requests with a suitable CSRF token, origin check, SameSite cookie policy, or another design that matches the authentication model.
Core Flow:
Browser Request + Ambient Credential → CSRF Validation → Allow or Reject State Change