Cross-Site Request Forgery (CSRF)

Also Known As

TL;DR

Explanation

CSRF exploits the browser's automatic inclusion of session cookies. An attacker hosts a page with a hidden form or image tag that sends a state-changing request to the target site. The victim's browser attaches their valid session cookie, so the server treats it as legitimate. Mitigation requires a per-session, per-form unpredictable token that the attacker cannot know — validated server-side with a constant-time comparison.

How It's Exploited

Diagram

sequenceDiagram
    participant V as Victim Browser
    participant L as "Legit Bank<br/>bank.com"
    participant A as "Attacker Site<br/>evil.com"
    V->>L: Login to bank.com
    L-->>V: Session cookie set
    A->>V: Serve malicious page with hidden form
    V->>L: "POST /transfer (auto-submit)<br/>Cookie sent automatically!"
    L-->>L: Transfer executed - no CSRF token checked
    Note over L: "Fix: require CSRF token in POST body<br/>that attacker cannot read"

Common Misconception

Why It Matters

Common Mistakes

• Protecting POST routes but forgetting PUT, PATCH, and DELETE — all state-changing methods need tokens.
• Validating the token exists but not validating it matches the session — presence check alone is useless.
• Disabling CSRF middleware globally in API routes and forgetting the app also serves browser clients.
• Using a static, never-rotating token — tokens must be per-session and ideally per-request.

Code Examples

// No CSRF token — any site can submit this form on behalf of the user
Route::post('/account/delete', [AccountController::class, 'destroy']);

// Laravel — CSRF middleware applied globally, @csrf in every form
<form method="POST" action="/account/delete">
    @csrf
    <button>Delete account</button>
</form>

// For APIs: use SameSite=Strict cookies + verify Origin header
if ($_SERVER['HTTP_ORIGIN'] !== 'https://yourapp.com') {
    http_response_code(403); exit;
}

References

• ↗ https://owasp.org/www-community/attacks/csrf
• ↗ https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html
• ↗ https://cwe.mitre.org/data/definitions/352.html

Tags

Related Terms