CSRF
/ˈsiː sɜːrf/ · Abbreviation · Security & Infosec · Origin: 2001
Definitions
Cross-Site Request Forgery — an attack that tricks a user's browser into making unintended requests to a site where the user is authenticated, leveraging the browser's automatic inclusion of cookies.
In plain English: A trick where a malicious website secretly makes your browser do things on another site where you're logged in, without you knowing.
The standard defense is a CSRF token — a random value included in forms that the server verifies on submission. Modern frameworks handle this automatically. The SameSite cookie attribute (now default in most browsers) provides additional protection by restricting when cookies are sent cross-origin.
Example: 'The pentest found a CSRF vulnerability on the account deletion endpoint. Adding a CSRF token to the form was a one-line fix in Django.'
Source: defense mechanisms
Etymology
- 2001
- Peter Watkins describes the 'Cross-Site Request Forgery' attack in a Bugtraq post, giving it its name
- 2007
- CSRF exploits drain bank accounts via online banking sites, forcing the financial industry to adopt anti-CSRF tokens
- 2012
- The SameSite cookie attribute is proposed to mitigate CSRF at the browser level, eventually becoming the default in Chrome
Origin Story
The attack that tricks your browser into making requests you didn't intend
**Cross-Site Request Forgery** was first described by Peter Watkins in 2001 on the Bugtraq mailing list, though the attack pattern existed earlier. The vulnerability exploits browsers' habit of automatically sending cookies with every request to a domain.
The attack is elegant: if you're logged into your bank, a malicious site can include an `<img src='bank.com/transfer?to=attacker&amount=10000'>` tag. Your browser dutifully sends the request with your bank cookies, and the transfer goes through. You never clicked anything.
CSRF protection became standard practice: synchronizer tokens (a random value the attacker can't guess), SameSite cookies (Chrome began enforcing this by default in 2020), and checking Referer headers. Despite being well-understood, CSRF vulnerabilities still appear regularly in bug bounty programs.
Coined by: Peter Watkins (described 2001), attack pattern existed earlier
Context: Bugtraq mailing list, 2001
Fun fact: CSRF is sometimes called 'session riding' or 'one-click attack.' The most dramatic historical CSRF was in a 2008 attack on home routers -- a malicious web page could change your router's DNS settings, redirecting all your traffic through an attacker's server.