Cross-Site Request Forgery

Overview

Cross-site request forgery (CSRF) is an attack by which unauthorized commands are submitted from a user that a web application trusts. An attack can succeed if three conditions are in place:

1. There is an action within the application an attacker wishes to induce.
2. The action involves issuing one or more HTTP requests authenticated using cookies.
3. The request does not contain parameters that cannot be determined or guessed.

With these in place, the attacker can trick a victim into triggering an HTTP request with the relevant parameters in place. The browser automatically sends cookies, including authorization cookies, thereby completing the action the attacker wished to induce.