← Back to glossary
🪃

CSRF (Cross‑Site Request Forgery)

Web Security

XSS (Cross‑Site Scripting) Security Headers Web Application Firewall (WAF) Session Management

Unwanted state-changing requests via authenticated browser context.

Definition

CSRF exploits automatic credential sending (cookies) by browsers to force a victim’s browser to perform authenticated state-changing requests without user intent.

In plain English Unwanted state-changing requests via authenticated browser context.

Why this matters

Why it matters: It can lead to unauthorized changes, transactions, and privacy-impacting account modifications.

Example

Example: Forged POST request executed because a session cookie is automatically attached.