Cross-Site Request Forgery (CSRF)

Cross-site request forgery (CSRF) exploits a browser’s ability to send credentials such as session cookies with requests to a site where the user is signed in. An attacker tries to cause the browser to perform an action the user did not intend, such as changing account settings or submitting a form. The attacker generally does not need to read the protected site’s response to make an unsafe request.

Web applications protect state-changing actions using appropriate anti-CSRF tokens, request-origin checks, and cookie defenses, together with sound authentication design. OWASP recommends token-based patterns in many circumstances and describes when the SameSite cookie attribute is a defense in depth rather than an adequate standalone guarantee. Applications also should avoid performing state-changing operations through supposedly safe GET requests.

A small business using WordPress, a booking portal, or a custom admin dashboard needs to keep its frameworks and security plugins maintained and ensure developers validate sensitive actions server-side. A hidden form field is not protection if the server never checks it. CSRF is different from cross-site scripting (XSS): CSRF forges an authenticated action, whereas XSS injects script into a trusted browsing context. Specific mitigations require attention to the application architecture.