CyberGuard dictionary / Web Application Security
Cross Site Request Forgery
Cross-site request forgery (CSRF) causes a signed-in browser to send an unwanted state-changing request to another site.
In simple terms
A malicious page can try to make your browser perform an action on a service where you are already logged in.
Technical explanation
Browsers may attach session cookies automatically. Defenses include unpredictable CSRF tokens, appropriate SameSite cookie settings, and Origin or Referer checks, with state-changing actions kept off safe HTTP methods. CORS alone is not a complete defense.
CSRF succeeds when a browser sends an authenticated state-changing request that the user did not intend. Tokens and origin checks help distinguish the legitimate application flow from a cross-site trigger.
Examples in practice
A forged form attempts to change an account email while the victim's browser still has an active session.
A user is signed into an account while visiting an unrelated page that submits a password-change form. The server rejects it because the request lacks the session-bound CSRF token.
Why it matters
Successful CSRF can make an application perform actions with the victim's privileges.
VERIFY & LEARN MORE
Sources and further reading
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.