CSRF learning path

Orientation and first principles — what the bug class is and how it behaves.

1. The Bug Bounty Guide to Exploiting CSRF Vulnerabilities - YesWeHack
   9 min readyeswehack.com2026
   Guide to exploiting Cross-Site Request Forgery (CSRF) vulnerabilities, detailing POST-based, GET-based, and stored CSRF attacks. It explains how attackers leverage a user's authenticated session to trick their browser into executing unauthorized actions, such as changing account settings or transferring funds. The guide illustrates real-world scenarios and payloads, including HTML forms for POST requests and image tags for GET requests, to demonstrate the mechanisms and impact of these vulnerabilities, emphasizing the exploitation of trust between browser and site without proper anti-CSRF protections.
2. Web Application Security: Anti-CSRF & Cookie SameSite Options
   12 min readbitsight.com2026
   Guide to implementing anti-CSRF tokens and Cookie SameSite options, detailing how CSRF attacks leverage GET and POST requests and exploit HTML forms with JavaScript. It explains the mechanics of hidden input fields and form submission, then introduces secret, randomly generated tokens as a primary defense, to be verified by the server upon form submission.
3. Cross-site request forgery - Wikipedia
   16 min readen.wikipedia.org2026
   Library detailing Cross-Site Request Forgery (CSRF) attacks, also known as one-click attacks. It explains how attackers exploit trust in a user's browser to submit unauthorized commands, impacting sites like Netflix, ING Direct, YouTube, and McAfee. The entry highlights the use of specially crafted image tags, hidden forms, JavaScript, and CVE-2008-6586 in μTorrent, emphasizing how cookies and GET requests facilitate these exploits.
4. CSRF - OWASP Foundation
   9 min readowasp.org2026
   Reference to Cross-Site Request Forgery (CSRF), an attack forcing authenticated users to execute unwanted actions. It details how attackers can trick victims via social engineering to perform state-changing requests, potentially compromising entire web applications or stealing private data through methods like login CSRF. The document highlights flawed prevention techniques and illustrates attack scenarios, including GET and POST request exploits, and mentions frameworks with built-in CSRF support and tools like OWASP CSRF Guard.
5. What is CSRF? Attacks, Mitigation, Prevention - Acunetix
   10 min readacunetix.com2026
   Reference on Cross-Site Request Forgery (CSRF), detailing its mechanism of tricking authenticated users into performing unintended actions, often via social engineering or malicious links. It highlights how CSRF leverages session cookies to bypass authentication, affecting state changes in web applications. The entry explains CSRF execution through both GET and POST requests, providing examples using HTML tags and JavaScript. It also touches upon prevention mechanisms like referer headers and custom X-Requested-With headers.

Real testing methodology, tooling, and writeups that show the work.

1. How to protect Node.js apps from CSRF attacks
   12 min readsnyk.io2026
   Library for protecting Node.js applications from CSRF attacks, detailing how these vulnerabilities exploit authenticated user sessions. It explains the mechanics of CSRF, the impact of successful attacks including data manipulation and account takeover, and practical protection strategies. Key techniques covered include the Synchronizer Token Pattern (STP), implementing SameSite cookies (strict and lax), and the Double Submit Cookie pattern.
2. CSRF in the Age of JSON
   5 min readdirectdefense.com2026
   Writeup on CSRF in the age of JSON, detailing how Cross-Site Request Forgery attacks persist against applications using JSON for data transfer. It covers challenges introduced by the `application/json` MIME type and Same-Origin Policy, exploring exploitation techniques such as manipulating content types to `text/plain` and leveraging weak CORS policies with `Access-Control-Allow-Origin` and `Access-Control-Allow-Credentials` headers. The writeup assumes an authorization model based on cookies and predictable request schemas, providing concrete examples of vulnerable requests and proof-of-concept exploits.
3. Preventing CSRF with the SameSite Cookie Attribute
   5 min readinvicti.com2026
   Reference detailing the SameSite cookie attribute for preventing Cross-Site Request Forgery (CSRF) attacks. It explains how cookies function and how browsers send them with third-party requests, enabling CSRF. The attribute, with 'Strict' and 'Lax' values, instructs browsers to control cookie transmission, mitigating attacks like those exploiting POST requests to sensitive endpoints. The entry also notes Netsparker's implementation of checks for this attribute.
4. Bypassing SameSite Cookie Restrictions - CSRF | PortSwigger
   8 min readportswigger.net2026
   Library for understanding and bypassing SameSite cookie restrictions. This resource details how SameSite's `Strict`, `Lax`, and `None` attributes function, including Chrome's default `Lax` behavior. It explains how to exploit misconfigurations and bypasses, particularly for CSRF attacks, by leveraging GET requests or scenarios where `SameSite=None` with the `Secure` attribute is used.
5. Avoiding CSRF Attacks with API Design
   12 min readthedreaming.org2025
   Reference on avoiding CSRF attacks through API design, emphasizing never using GET to modify state and implementing CSRF tokens. It details how malicious websites can exploit GET requests and basic POST forms, and suggests using CSRF tokens as a hidden field or header. The article also touches on stateless "double submit cookies" and considerations for non-browser API clients, mentioning the `csurf` library for Express.

Novel research, edge cases, and the techniques that push the class forward.

1. CSRF: Advanced Exploitation Guide - Intigriti
   8 min readintigriti.com2026
   Guide to advanced CSRF exploitation techniques, detailing how to identify and exploit vulnerabilities by understanding conditions like the `SameSite` cookie policy and the absence of unpredictable tokens. It covers bypassing Content-Type and method-based restrictions, as well as exploiting weaknesses in anti-CSRF token validation and Referer header checks.
2. Advanced CSRF: How to Bypass SameSite Cookie Protections
   4 min readsajjapremsai.github.io2026
   Library detailing bypass techniques for SameSite cookie protections, which default to Lax in Chrome. It explains the distinction between Site and Origin, the three SameSite restriction levels (Strict, Lax, None), and demonstrates how misconfigured servers can be exploited. The article outlines methods to bypass Lax restrictions using GET requests, even when POST is expected, and circumvent Strict protections through third-party redirect gadgets, particularly client-side JavaScript.
3. Chaining Stored XSS and CSRF in Typemill CMS: A Deep Dive into Attribute Injection
   infosecwriteups.com2026
   A security assessment of Typemill CMS revealed a high-severity vulnerability chain (CVE-2026–53468) combining Stored XSS and CSRF. The flaw allows attackers to bypass frontend validation and inject malicious scripts into page metadata, ultimately enabling admin session hijacking. This exploit targets Typemill, a PHP and Slim framework-based flat-file CMS.
4. Advanced Techniques to Bypass CSRF Defenses
   medium.com2026
   Advanced Techniques to Bypass CSRF Defenses