Definition
Cross-Site Request Forgery (CSRF) is a security vulnerability where an attacker tricks an authenticated user into making an unwanted request to a web application, potentially executing unauthorized commands on behalf of the user.How It Works
- 1An attacker creates a malicious request to perform an action on a target website.
- 2The attacker deceives a user, who is logged into the website, to execute this request, often through a link or image.
- 3The website processes the request as legitimate due to the authenticated user session.
Key Characteristics
- Depends on authenticated sessions in web applications.
- Exploits the trust a site places in the user's browser.
- Actions are often invisible to users, occurring in the background.
Comparison
| Feature | CSRF | XSS (Cross-Site Scripting) |
|---|---|---|
| Target | User actions | User's browser |
| Exploitation Method | User-induced requests | Script injection |
| User Interaction | Required | Not always required |
Real-World Example
In 2008, Netflix faced a CSRF vulnerability allowing attackers to change users' account settings by tricking them into visiting a malicious site while logged in.Detection & Prevention
- Anti-CSRF Tokens: Unique tokens added to forms to validate requests.
- SameSite Cookies: Limits how cookies are sent with cross-site requests.
- Testing Tools: Employ Burp Suite or OWASP ZAP to identify CSRF vulnerabilities.
Common Misconceptions
- CSRF is the same as XSS: Incorrect. CSRF doesn't involve script injection.
- CSRF only affects banking sites: Incorrect. Any site with user sessions can be affected.
- HTTPS prevents CSRF: Misleading. HTTPS secures data transfer but doesn't stop CSRF.