+1 coinfor reading to the end
+1
Home / Glossary / CSRF
Glossary · Security

CSRF

Cross-site Request Forgery

In plain language

An attack that tricks your browser into sending a request to a site where you are already signed in.

The metaphor

Like a forged letter slipped into your outbox that your assistant mails without checking, because it looks like your handwriting.

Going deeper

How it works

  • You are signed in to a site.
  • You click a link or open a page that secretly sends a request to that site.
  • The site sees your valid session and acts.
  • Sites defend with special tokens on each form.
In practice
  • A banking site rejects requests with no token.
  • A developer adds protection to an admin panel.
  • A user signs out of sensitive sites when finished.

A question owners ask

What can I do?

Sign out of important sites when done, and keep browsers updated.

Related terms
AAAAuthentication, Authorization, and AccountingAccount takeoverACLAccess Control ListAdmin accountAESAdvanced Encryption StandardAES-256Advanced Encryption Standards 256-bitAISAutomated Indicator SharingAPTAdvanced Persistent Threat

Something here sounds like your problem?

Every WILDCARD card exists to solve one named problem. Find yours.

Pick your problem →