The newest Cross-Site Request Forgery (CSRF) resources are on the Cross-Site Request Forgery (CSRF) page. For a reading order instead of a date order, see the Cross-Site Request Forgery (CSRF) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-19 2026 | CVE-2025-23797: WP Options Editor CSRF Vulnerability news 4 min read | Writeup of CVE-2025-23797, a Cross-Site Request Forgery vulnerability affecting the WP Options Editor WordPress plugin. This flaw, present in versions up to 1.1, allows unauthenticated attackers to trick administrators into clicking malicious links, leading to privilege escalation by modifying critical WordPress options like `default_role` and user capabilities without proper nonce verification. Mitigation requires immediate deactivation and removal of the plugin, auditing options, and verifying administrator accounts. → sentinelone.com |
| 2026-04-19 2026 | Web Security Academy: CSRF SameSite Lax Bypass via Method Override intermediate | Web Security Academy: CSRF SameSite Lax Bypass via Method Override |
| 2026-04-16 2026 | Modern CSRF Mitigation in Single Page Applications intermediate | Modern CSRF Mitigation in Single Page Applications |
| 2026-04-16 2026 | CSRF in the Age of JSON intermediate 5 min read | Writeup on CSRF in the age of JSON, detailing how Cross-Site Request Forgery attacks persist against applications using JSON for data transfer. It covers challenges introduced by the `application/json` MIME type and Same-Origin Policy, exploring exploitation techniques such as manipulating content types to `text/plain` and leveraging weak CORS policies with `Access-Control-Allow-Origin` and `Access-Control-Allow-Credentials` headers. The writeup assumes an authorization model based on cookies and predictable request schemas, providing concrete examples of vulnerable requests and proof-of-concept exploits. |
| 2026-04-16 2026 | Top 25 CSRF Bug Bounty Reports intermediate | Top 25 CSRF Bug Bounty Reports → corneacristian.medium.com |
| 2026-04-16 2026 | The Bug Bounty Guide to Exploiting CSRF Vulnerabilities - YesWeHack beginner 9 min read | Guide to exploiting Cross-Site Request Forgery (CSRF) vulnerabilities, detailing POST-based, GET-based, and stored CSRF attacks. It explains how attackers leverage a user's authenticated session to trick their browser into executing unauthorized actions, such as changing account settings or transferring funds. The guide illustrates real-world scenarios and payloads, including HTML forms for POST requests and image tags for GET requests, to demonstrate the mechanisms and impact of these vulnerabilities, emphasizing the exploitation of trust between browser and site without proper anti-CSRF protections. → yeswehack.com |
| 2026-04-16 2026 | CSRF: Advanced Exploitation Guide - Intigriti advanced 8 min read | Guide to advanced CSRF exploitation techniques, detailing how to identify and exploit vulnerabilities by understanding conditions like the `SameSite` cookie policy and the absence of unpredictable tokens. It covers bypassing Content-Type and method-based restrictions, as well as exploiting weaknesses in anti-CSRF token validation and Referer header checks. → intigriti.com |
| 2026-04-10 2026 | Web Application Security: Anti-CSRF & Cookie SameSite Options beginner 12 min read | Guide to implementing anti-CSRF tokens and Cookie SameSite options, detailing how CSRF attacks leverage GET and POST requests and exploit HTML forms with JavaScript. It explains the mechanics of hidden input fields and form submission, then introduces secret, randomly generated tokens as a primary defense, to be verified by the server upon form submission. |
| 2026-04-10 2026 | CSRF Protection - Clerk Docs beginner 2 min read | Guide to CSRF protection detailing Cross-Site Request Forgery attacks and how to mitigate them using the `SameSite` cookie attribute. It explains the `Strict`, `Lax`, and `None` values for `SameSite` and highlights that Clerk configures session cookies with `Lax`, the modern browser default, to prevent CSRF without degrading user experience. The guide emphasizes that navigation alone should not trigger backend mutations to avoid XSS vulnerabilities. |
| 2026-04-10 2026 | Preventing CSRF with the SameSite Cookie Attribute intermediate 5 min read | Reference detailing the SameSite cookie attribute for preventing Cross-Site Request Forgery (CSRF) attacks. It explains how cookies function and how browsers send them with third-party requests, enabling CSRF. The attribute, with 'Strict' and 'Lax' values, instructs browsers to control cookie transmission, mitigating attacks like those exploiting POST requests to sensitive endpoints. The entry also notes Netsparker's implementation of checks for this attribute. → invicti.com |
| 2026-04-10 2026 | CSRF Attacks: Bypassing SameSite Cookies intermediate 2 min read | Guide to bypassing SameSite cookies in CSRF attacks, detailing methods like exploiting Lax policy GET requests, using 307/308 redirects, and leveraging subdomain takeovers. It covers testing methodologies and mitigation techniques for developers, including SameSite=Strict and CSRF tokens. |
| 2026-04-10 2026 | Advanced CSRF: How to Bypass SameSite Cookie Protections advanced 4 min read | Library detailing bypass techniques for SameSite cookie protections, which default to Lax in Chrome. It explains the distinction between Site and Origin, the three SameSite restriction levels (Strict, Lax, None), and demonstrates how misconfigured servers can be exploited. The article outlines methods to bypass Lax restrictions using GET requests, even when POST is expected, and circumvent Strict protections through third-party redirect gadgets, particularly client-side JavaScript. |
| 2026-04-10 2026 | CSRF & Bypasses - Cobalt intermediate 7 min read | Library exploring Cross-Site Request Forgery (CSRF) vulnerabilities, detailing attack flows, exploitation techniques against applications without defenses, and various bypass methods. It covers bypassing CSRF token validations by changing request methods or removing tokens, and other bypasses including Referer header manipulation, content type checks, session fixation, SameSite cookie attribute exploitation, and Laravel-specific token manipulation. → cobalt.io |
| 2026-04-10 2026 | Cross-site request forgery - Wikipedia beginner 16 min read | Library detailing Cross-Site Request Forgery (CSRF) attacks, also known as one-click attacks. It explains how attackers exploit trust in a user's browser to submit unauthorized commands, impacting sites like Netflix, ING Direct, YouTube, and McAfee. The entry highlights the use of specially crafted image tags, hidden forms, JavaScript, and CVE-2008-6586 in μTorrent, emphasizing how cookies and GET requests facilitate these exploits. |
| 2026-04-10 2026 | CSRF - OWASP Foundation beginner 9 min read | Reference to Cross-Site Request Forgery (CSRF), an attack forcing authenticated users to execute unwanted actions. It details how attackers can trick victims via social engineering to perform state-changing requests, potentially compromising entire web applications or stealing private data through methods like login CSRF. The document highlights flawed prevention techniques and illustrates attack scenarios, including GET and POST request exploits, and mentions frameworks with built-in CSRF support and tools like OWASP CSRF Guard. → owasp.org |
| 2026-04-10 2026 | CSRF: Cross Site Request Forgery Example - Imperva beginner 3 min read | Library for detecting and preventing Cross-Site Request Forgery (CSRF) attacks, detailing how these attacks trick users into performing unwanted actions via forged requests embedded in links or forms. The resource highlights common CSRF attack vectors, using a bank transfer example, and discusses mitigation techniques such as unique session tokens, double cookie submission, and custom rules like those found in Imperva's IncapRules engine, which can filter requests based on HTTP referrer headers to counter social engineering. → imperva.com |
| 2026-04-10 2026 | CWE-352: Cross-Site Request Forgery beginner | CWE-352: Cross-Site Request Forgery |
| 2026-04-10 2026 | What Is CSRF? - Palo Alto Networks beginner 24 min read | Reference defining CSRF (CWE-352), a web application attack exploiting session-based authentication to trick authenticated users into submitting unintended requests. Attackers leverage the browser's automatic inclusion of session cookies to perform unauthorized actions on behalf of the user without their knowledge or consent, such as changing settings or initiating transactions. This technique plays a supporting role in MITRE ATT&CK techniques like T1530. → paloaltonetworks.com |
| 2026-04-10 2026 | What is CSRF? Attacks, Mitigation, Prevention - Acunetix beginner 10 min read | Reference on Cross-Site Request Forgery (CSRF), detailing its mechanism of tricking authenticated users into performing unintended actions, often via social engineering or malicious links. It highlights how CSRF leverages session cookies to bypass authentication, affecting state changes in web applications. The entry explains CSRF execution through both GET and POST requests, providing examples using HTML tags and JavaScript. It also touches upon prevention mechanisms like referer headers and custom X-Requested-With headers. → acunetix.com |
| 2026-04-10 2026 | CSRF Attacks - Rapid7 beginner 5 min read | Reference defining Cross-Site Request Forgery (CSRF) attacks, detailing how they exploit user trust and authenticated sessions to perform unauthorized actions, such as money transfers or account alterations. It covers attack mechanisms, including social engineering and stored CSRF via XSS like the Samy MySpace worm, and highlights impacts on services like Gmail and Facebook. Prevention strategies emphasize enabling CSRF protection, utilizing CSRF tokens, and conducting regular web application security testing and penetration testing to mitigate risks. → rapid7.com |
| 2026-04-06 2026 | Cookies: HTTP State Management Mechanism (RFC 6265bis) beginner 34 min read | Reference document defining HTTP Cookie and Set-Cookie header fields. It details how servers store state at user agents for session management, superseding RFC 6265. The specification clarifies cookie scope, attributes like "Secure", and addresses historical security and privacy flaws, recommending a well-behaved profile for servers and liberal processing for user agents to maximize interoperability. |
| 2026-04-06 2026 | CVE-2026-34394: Wwbn Avideo CSRF Vulnerability news 4 min read | Analysis of CVE-2026-34394 reveals a critical Cross-Site Request Forgery (CSRF) vulnerability in WWBN AVideo. The admin plugin configuration endpoint, admin/save.json.php, fails to validate CSRF tokens and bypasses table security checks. This, combined with a SameSite=None cookie policy, allows attackers to overwrite arbitrary plugin settings by crafting forged cross-origin POST requests, potentially compromising payment processors, authentication providers, and cloud storage credentials. Mitigation involves restricting administrative access, implementing WAF rules, and advising administrators on secure browsing habits. → sentinelone.com |
| 2026-04-06 2026 | Cross-site request forgery (CSRF) - Security - MDN Web Docs beginner 8 min read | Reference detailing Cross-Site Request Forgery (CSRF) attacks, where attackers trick browsers into executing unwanted actions on legitimate sites by exploiting session cookies. It outlines attack vectors using forms and image tags, and explores defenses including CSRF tokens, Fetch metadata headers (specifically `Sec-Fetch-Site`), making requests non-simple by setting `Content-Type` to `application/json` or custom headers, and the `SameSite` cookie attribute for defense in depth. Modern frameworks like Django offer built-in CSRF token protection. |
| 2026-04-03 2026 | CSRF Exploitation Techniques — Flaws, Bypasses & SameSite Cookie Mechanics intermediate | CSRF Exploitation Techniques — Flaws, Bypasses & SameSite Cookie Mechanics |
| 2026-04-03 2026 | Lab: SameSite Lax Bypass via Cookie Refresh | PortSwigger intermediate 4 min read | Lab demonstrating a CSRF attack to bypass SameSite cookie restrictions. This lab involves changing a victim's email address by exploiting a vulnerable account change function. The technique focuses on a SameSite Lax bypass via cookie refresh, requiring an attacker to circumvent browser popup blockers and induce user interaction to trigger the necessary OAuth flow and subsequent email modification. → portswigger.net |
| 2026-04-03 2026 | Lab: SameSite Lax Bypass via Method Override | PortSwigger intermediate 2 min read | Lab: SameSite Lax bypass via method override details a Cross-Site Request Forgery (CSRF) vulnerability within the "change email" function. The lab demonstrates how to bypass SameSite cookie restrictions, specifically the Lax default, by crafting a GET request that overrides the intended POST method using the `_method` parameter. The solution involves using an exploit server to trigger a top-level navigation that sends the malicious request, ultimately changing the victim's email address. → portswigger.net |
| 2026-04-03 2026 | Advanced Techniques to Bypass CSRF Defenses advanced | Advanced Techniques to Bypass CSRF Defenses |
| 2026-04-03 2026 | Cross-Site Request Forgery (CSRF) Attack Guide | Hackviser beginner 7 min read | Guide to Cross-Site Request Forgery (CSRF) attacks, detailing its mechanics through examples like manipulated image tags and auto-submitting forms. It outlines manual testing techniques for CSRF token validation, HTTP methods, content types, and referrer headers. The guide also covers automated discovery using tools such as Burp Suite extensions (CSRF Scanner, CSurfer, Auto CSRF), XSRFProbe, and custom Python scripts, along with specific attack vectors including GET-based, POST-based, and JSON CSRF. |
| 2026-04-03 2026 | CSRF (Cross Site Request Forgery) | HackTricks beginner 14 min read | Reference detailing Cross-Site Request Forgery (CSRF) vulnerabilities, explaining how attackers exploit authenticated sessions to perform actions on behalf of users. It covers exploitation conditions, countermeasures like SameSite cookies, CORS, user verification, referrer checks, and CSRF tokens. The resource also highlights common anti-patterns, such as bypassing CSRF protections on non-POST verbs through method overrides and inadequate token validation tied to global pools. → book.hacktricks.xyz |
| 2026-04-03 2026 | Bypassing SameSite Cookie Restrictions - CSRF | PortSwigger intermediate 8 min read | Library for understanding and bypassing SameSite cookie restrictions. This resource details how SameSite's `Strict`, `Lax`, and `None` attributes function, including Chrome's default `Lax` behavior. It explains how to exploit misconfigurations and bypasses, particularly for CSRF attacks, by leveraging GET requests or scenarios where `SameSite=None` with the `Secure` attribute is used. → portswigger.net |
| 2026-04-03 2026 | CSRF & Bypasses | Cobalt intermediate 7 min read | Library detailing Cross-Site Request Forgery (CSRF) vulnerabilities and bypass techniques. It covers how CSRF attacks exploit authenticated users to perform unwanted actions, including exploitation via GET requests, IMG tags, and POST requests. Specific bypass methods discussed include altering request methods, removing CSRF token parameters, manipulating referrer headers, content type checks, and exploiting SameSite cookie attributes through client-side redirects. The resource also touches on bypassing CSRF protection in frameworks like Laravel and utilizing session fixation. → cobalt.io |
| 2026-04-03 2026 | Cross-Site Request Forgery Prevention Cheat Sheet | OWASP beginner 40 min read | Library: OWASP Cross-Site Request Forgery Prevention Cheat Sheet. This resource details Cross-Site Request Forgery (CSRF) attacks, where attackers trick users' browsers into performing unwanted actions on trusted sites. It recommends defenses including framework-built-in protection, synchronizer tokens for stateful applications, and double submit cookies for stateless applications. Techniques like Fetch Metadata headers, SameSite cookie attributes, and user interaction-based protection are also discussed, alongside the crucial understanding that Cross-Site Scripting (XSS) can undermine CSRF mitigations. → cheatsheetseries.owasp.org |
| 2025-09-25 2025 | Side-by-Side Comparison of SSRF vs. CSRF | Attaxion beginner 9 min read SSRF | Library detailing Server-Side Request Forgery (SSRF) and Cross-Site Request Forgery (CSRF) attacks, highlighting SSRF's CWE-918 classification and its role in incidents like the Capital One breach and Microsoft Exchange attacks (CVE-2021-26855). It contrasts SSRF's server-targeting nature with CSRF's browser-based exploitation of authenticated users, explaining attack mechanisms and detection methods using tools like OWASP ZAP. |
| 2025-08-14 2025 | devanshbatham/Vulnerabilities-Unmasked beginner 14 min read IDOR XSS | Library providing simplified explanations and analogies for common web vulnerabilities, including Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), SQL Injection, ClickJacking, Subdomain Takeover, Privilege Escalation, Role-Based Access Control (RBAC) Vulnerabilities, Server-Side Request Forgery (SSRF), Vulnerable and Outdated Components, Local File Inclusion (LFI), Denial of Service (DOS), Authentication Bypass, Insecure Direct Object Reference (IDOR), 2FA Bypass, and Race Condition Vulnerability. |
| 2025-08-14 2025 | In Praise of CSRF Tokens – Tim MalcomVetter – Medium beginner | The content titled "In Praise of CSRF Tokens" by Tim MalcomVetter on Medium likely discusses the importance and benefits of Cross-Site Request Forgery (CSRF) tokens in web security. CSRF tokens are used to prevent unauthorized actions on websites by verifying the origin of requests. The article may highlight how CSRF tokens enhance security measures and protect against malicious attacks. It likely emphasizes the significance of implementing CSRF tokens to safeguard user data and maintain the integrity of web applications. |
| 2025-08-14 2025 | Facebook GraphQL CSRF – These aren't the access_tokens you're looking for intermediate GraphQL | The content seems to highlight a potential security issue related to Facebook's GraphQL service, specifically concerning Cross-Site Request Forgery (CSRF) attacks. It suggests that access tokens may not be the main target for such attacks. This implies that there may be vulnerabilities in the handling of GraphQL requests that could be exploited by malicious actors. It serves as a cautionary note for users and developers to be aware of potential CSRF risks when using Facebook's GraphQL service. |
| 2025-08-14 2025 | Wiping out CSRF beginner | The content discusses Cross-Site Request Forgery (CSRF) attacks and the importance of implementing secure practices to prevent them. It highlights the risks associated with CSRF attacks, such as unauthorized actions on behalf of users. The author emphasizes the significance of using anti-CSRF tokens and secure coding practices to mitigate these risks. By incorporating these measures, websites can enhance their security and protect users from CSRF vulnerabilities. |
| 2025-08-14 2025 | Bypassing CSRF tokens with pythons cgihttpserver intermediate 1 min read | Writeup detailing how to bypass CSRF tokens using Python's `cgihttpserver`. This technique leverages the server's behavior to potentially submit requests without valid tokens, offering a practical approach to testing CSRF defenses. The article, while not directly a library, demonstrates a specific vulnerability exploitation method relevant to application security professionals. |
| 2025-08-14 2025 | web application - Should login and logout action have CSRF protection? - In beginner 4 min read | Analysis of CSRF protection for web application login and logout actions, detailing how attackers can exploit login CSRF to redirect victims to attacker-controlled accounts, enabling credential hijacking and content manipulation. It also highlights the risks of logout CSRF, particularly when combined with phishing attacks or other vulnerabilities like self XSS, to facilitate account takeovers and persistent remote JavaScript execution, referencing scenarios like the LostPass exploit and WAF bypass techniques. |
| 2025-08-14 2025 | Using CORS policies to implement CSRF protection | Mixmax beginner 7 min read | Library for layering CSRF protection atop traditional CORS policies, named `cors-gate`. This Node module utilizes an Origin-based approach, complementing CORS by checking the `Origin` and `Referer` headers to prevent unauthorized cross-site requests. It addresses limitations of CORS alone, which can fail to block certain requests, and offers a modern solution for mitigating CSRF vulnerabilities. The library requires modern browser functionality and does not support older browsers. |
| 2025-08-14 2025 | Cross-Site Request Forgery is dead! beginner 8 min read | Reference detailing Cross-Site Request Forgery (CSRF) vulnerabilities and their solution via Same-Site Cookies. The article explains CSRF attacks, traditionally mitigated by checking Origin/Referer headers or employing Anti-CSRF tokens, and highlights the simplicity and effectiveness of Same-Site Cookies. It describes `Strict` and `Lax` modes for Same-Site Cookies, offering robust protection against CSRF by instructing browsers not to send cookies on cross-origin requests, with `Lax` allowing exceptions for top-level navigations using safe HTTP methods like GET. |
| 2025-08-14 2025 | oauth 2.0 - How does CSRF work without state parameter in OAuth2.0? - Stack intermediate 1 min read | Reference on CSRF vulnerabilities in OAuth 2.0, detailing an attack flow where an attacker intercepts a callback URL and tricks a logged-in user into visiting it. This exploit allows the attacker to gain unauthorized access to the victim's account on the service provider by exchanging the resulting authorization code for an access token. The discussion specifically questions the role of the state parameter in preventing such Cross-Site Request Forgery attacks within the OAuth 2.0 framework. → stackoverflow.com |
| 2025-08-14 2025 | WordPress Front End Security: CSRF and Nonces | CSS-Tricks beginner 5 min read | Library of WordPress functions for preventing Cross-Site Request Forgery (CSRF) attacks, including `wp_nonce_field`, `wp_verify_nonce`, `wp_nonce_url`, `wp_create_nonce`, and `check_ajax_referer`. These tools generate and validate unique, one-time use tokens (nonces) to ensure user actions, such as form submissions or URL clicks, are legitimate and not maliciously forged by attackers, protecting against vulnerabilities like those found in the WP SEO plugin. |
| 2025-08-14 2025 | ruby - Sinatra CSRF Authenticity tokens - Stack Overflow beginner | Library demonstrating CSRF authenticity tokens in the Sinatra web framework. This resource addresses how to implement CSRF protection, specifically noting Sinatra's use of Rack Protection. It provides guidance on generating or utilizing these tokens to secure user input forms within Sinatra applications. → stackoverflow.com |
| 2025-08-14 2025 | Avoiding CSRF Attacks with API Design intermediate 12 min read | Reference on avoiding CSRF attacks through API design, emphasizing never using GET to modify state and implementing CSRF tokens. It details how malicious websites can exploit GET requests and basic POST forms, and suggests using CSRF tokens as a hidden field or header. The article also touches on stateless "double submit cookies" and considerations for non-browser API clients, mentioning the `csurf` library for Express. |
| 2025-08-14 2025 | Samesite by Default and What It Means for Bug Bounty Hunters intermediate 4 min read Bug Bounty XSS | Reference on SameSite by Default impacting bug bounty hunting, detailing its effects on Clickjacking, Cross-Site Script Inclusion (XSSI), JSONP leaks, Data Exfiltration, XSLeaks, CORS misconfigurations, Cross-Site WebSocket Hijacking, and XSS. The shift to SameSite=Lax for cookies by default in Chrome 80 alters cross-origin request authentication, impacting vulnerabilities beyond traditional CSRF. |
| 2025-08-14 2025 | Bypass SameSite Cookies Default to Lax and get CSRF intermediate | The content highlights a security vulnerability where bypassing SameSite cookies set to the default "Lax" mode can lead to Cross-Site Request Forgery (CSRF) attacks. This vulnerability allows malicious actors to exploit the lax SameSite cookie setting to perform unauthorized actions on behalf of a user. It emphasizes the importance of properly configuring SameSite cookie settings to prevent CSRF attacks and ensure the security of web applications. |
| 2025-08-14 2025 | Account takeover using CSRF JSON based intermediate | The article discusses a security vulnerability known as Cross-Site Request Forgery (CSRF) that can lead to an account takeover when combined with JSON-based attacks. It explains how CSRF works, the impact it can have on user accounts, and how attackers can exploit it to gain unauthorized access. The author provides a detailed explanation of the attack scenario and suggests preventive measures to protect against CSRF and JSON-based attacks. Overall, the article highlights the importance of understanding and mitigating these security risks to safeguard user accounts and sensitive data. |
| 2025-08-14 2025 | What is CSRF (Cross-site request forgery)? Tutorial & Examples | Web Security Academy beginner 6 min read | Reference on Cross-Site Request Forgery (CSRF) detailing what it is, common vulnerabilities, and how to prevent it. The resource explains how attackers exploit cookie-based session handling and lack of unpredictable request parameters to make users perform unintended actions like changing email addresses or transferring funds. It also covers constructing and delivering CSRF attacks using tools like Burp Suite Professional and discusses common defenses such as CSRF tokens, SameSite cookies, and Referer-based validation. → portswigger.net |
| 2022-03-17 2022 | Favorite tweet by @manicode news | Favorite tweet: Oldie but a good one. Old school #CSRF against @netflix https://t.co/kSVU9VP65D — Jim Manico (@manicode) Mar 17, 2022 |