Glossary term
What is CSRF (Cross-Site Request Forgery)?
CSRF stands for Cross-Site Request Forgery.
In System Design
Tricks your browser into sending requests with your cookies. Example: A hidden form that transfers money.
Learn it properly · System DesignLesson 49: Authentication vs Authorization: Sessions, Cookies & JWTEvery endpoint checked “is the user logged in?” — and changing one number in the URL showed another customer's invoice. Authentication vs authorization, storing passwords, MFA and passkeys, sessions vs JWTs (with a live token to tamper with), and RBAC, ABAC and ReBAC.In The Browser Contract
Another site makes the user's browser send a request to your site. The browser adds the user's cookies by itself.
Learn it properly · The Browser ContractLesson 3: Where Do Tokens Live? XSS, CSRF and the Storage Trade-offlocalStorage lets XSS steal tokens. Cookies let CSRF attacks use you. Safe patterns: HttpOnly cookies with SameSite or CSRF tokens, access tokens kept in memory, and a backend-for-frontend.In Security for Developers
Another site makes the user's browser send a request to your site, and the browser attaches the user's cookie automatically.
Learn it properly · Security for DevelopersLesson 2: XSS, CSRF, Clickjacking and Security HeadersHow a script gets into your page and how to stop it with output encoding and CSP, how CSRF uses your cookies, SameSite and CSRF tokens, frame-ancestors, and the headers worth setting.