Attack that tricks authenticated users into unknowingly performing unwanted actions on web applications.
Cross-Site Request Forgery (CSRF) tricks users into executing unwanted actions on websites where they're authenticated. Attackers craft malicious requests that, when triggered (via email links, hidden images, or scripts), execute using the victim's existing session. Because the victim is legitimately logged in, the application processes the request as authorised. CSRF can change passwords, transfer funds, modify settings, or any action the user can perform. Anti-CSRF tokens that verify request origin are the primary defence.
Why It Matters
The DSC Perspective:
CSRF exploits trust between users and applications. Even security-aware users can fall victim if applications lack CSRF protection. Ensure your web applications implement anti-CSRF tokens.