Cross-site request forgery (CSRF)

Cross-site request forgery, or CSRF, also called XSRF, is an attack in which another website induces the browser to send an unwanted request to a target application. If the browser automatically includes valid credentials and suitable protection is missing, the application may treat the request as an instruction from the signed-in person.

A change in a project portal

A fictional project portal allows the notification address to be changed in the notificationEmail field. A person is signed in there and also visits another page. That page attempts to trigger the change. Whether the session cookie is included depends, among other things, on the browser's cookie rules.

Checking a valid session cookie establishes which session the request belongs to. It does not prove that the person intended this address change. Using POST alone does not prevent the attack either.

Protecting state-changing requests

For a form, the framework can provide an unpredictable CSRF token tied to the session. The server checks this additional value before making the change. The protection must actually be used for the relevant requests.

MDN also describes checks based on Fetch metadata, meaning browser-provided request-context information, and other methods appropriate to the request type. The SameSite cookie attribute is an additional layer of protection. The same site and the same origin (scheme, hostname and port) are not equivalent; different subdomains can belong to the same site. A valid CSRF token also does not replace checking whether the signed-in person is permitted to change the address.

Sources

• MDN — Cross-site request forgery (CSRF)

• MDN — Origin