Cross-Site Request Forgery (CSRF) Resources

Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) is an attack that forces an authenticated user to execute unwanted actions on a web application. CSRF attacks target state-changing requests — not data theft — since the attacker cannot see the response to the forged request.

CSRF exploits the browser's automatic inclusion of credentials (cookies, HTTP auth) with every request to a domain. If a user is logged into a banking site and visits a malicious page, that page can submit a hidden form to the banking site — and the browser will attach the user's session cookie automatically. The impact ranges from changing email addresses and passwords to transferring funds and modifying account settings.

While SameSite cookie attributes and CSRF tokens have significantly reduced the attack surface, bypasses continue to emerge. Common techniques include exploiting misconfigured SameSite policies, token fixation, subdomain takeover to bypass origin checks, and leveraging CORS misconfigurations. JSON-based CSRF using Flash or content-type tricks has historically been a rich area for bypasses, and new browser behaviors regularly shift what's exploitable.

CSRF is often combined with other vulnerabilities — an XSS bug can extract CSRF tokens, and open redirects can be used to leak tokens through the Referer header.

This page collects CSRF research, bypass techniques, defense mechanisms, and real-world writeups demonstrating exploitation in modern applications.

From OWASP