CSRF: making the victim's browser act

February 8, 2026 · 1 min read · #web #csrf #authentication

Cross-site request forgery abuses the fact that session cookies are sent automatically. A malicious site sends a request to your site and the browser attaches the victim's cookie.

<form action="https://bank.com/transfer" method="POST">
  <input name="to" value="attacker">
  <input name="amount" value="5000">
</form><script>document.forms[0].submit()</script>

Defence

Anti-CSRF token: a random per-session value, put in every form and verified server-side. The other site does not know it.

SameSite cookies: SameSite=Lax (modern default) blocks the cookie on cross-site POST requests; Strict even on navigation. A baseline defence but not a full replacement for tokens.

Also check the Origin/Referer header for sensitive actions.

« back to home