LearnViz CompSci
Home / Learn / Security & Cryptography / CSRF

Intermediate Topic 26 of 51 Security & Cryptography

CSRF

Attack tricking a user's browser into unwanted requests.

How it works

Cross-site request forgery tricks a logged-in user's browser into sending an unwanted request to a site where it is authenticated. Because browsers automatically attach cookies, a malicious page can submit a hidden form or request to a bank or admin endpoint, and the server cannot tell it was not intended by the user. It targets state-changing actions such as changing an email, transferring money or deleting data.

Step-by-step walkthrough

  1. The victim is logged in to the bank.
  2. They visit the attacker's page.
  3. The page makes the browser send a transfer request.
  4. The browser attaches the bank cookie automatically.
  5. The bank acts on it, so use SameSite cookies and anti-CSRF tokens.

Where it is used

Defenses include anti-CSRF tokens tied to the session and checked on each state-changing request, SameSite cookie attributes, checking the Origin or Referer headers and requiring custom headers for APIs.

Common pitfall

Using GET for state changes makes attacks trivial. Token validation that is optional or shared across users does not help. SameSite defaults vary by browser, so do not rely on them alone. CSRF is different from XSS, though XSS can defeat CSRF tokens. Token-based APIs sending credentials manually are less exposed than cookie-based sessions.

Where it fits in the course

CSRF is topic 26 of 51 in Security & Cryptography, rated Intermediate. It follows Cross-Site Scripting. The next topic is Buffer Overflow.

Practice and explore

How to study this topic

  1. Read the explanation above and restate the definition in your own words.
  2. Open the interactive lesson and answer its mini quiz.
  3. Read the common pitfall, then write a short example that avoids it.
  4. Check your understanding in the Security & Cryptography quiz, and revisit the topic if you miss a question.

Frequently asked questions

What is CSRF?
Attack tricking a user's browser into unwanted requests. It belongs to Security & Cryptography and is an intermediate-level topic.
Where do people use CSRF?
Defenses include anti-CSRF tokens tied to the session and checked on each state-changing request, SameSite cookie attributes, checking the Origin or Referer headers and requiring custom headers for APIs.
What is the most common mistake with CSRF?
Using GET for state changes makes attacks trivial.
What should I learn before this topic?
Start with Cross-Site Scripting, the topic just before it in Security & Cryptography.
How can I practice it?
Answer the mini quiz in the interactive lesson, then take the Security & Cryptography quiz.
Is CSRF hard to learn?
It is an Intermediate topic. Be comfortable with the Beginner topics in this area first, then read the common pitfall carefully, since it is where most mistakes happen.
How long does it take to learn CSRF?
Most learners can read the explanation and finish the interactive lesson in under an hour. Fluency comes from applying the idea, so plan a few short practice sessions with the quiz.
Which topics are related to CSRF?
Cross-Site Scripting, Buffer Overflow, SQL Injection are closely connected. The full list is in the related topics section of this page.
What should I study after CSRF?
Continue with Buffer Overflow, the next topic in Security & Cryptography.

Related topics