Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) is an attack that forces an authenticated user to execute unwanted actions on a web application where they are currently authenticated. CSRF exploits the trust that a web application has in the user's browser.

CSRF attacks can change account details, make purchases, transfer funds, or perform any action the authenticated user is authorized to do. Because the attack uses the victim's own authentication, the server cannot distinguish between a legitimate request and a forged one without proper protections.