ORCIDGitHubLinkedIn
RSS Curriculum Vitae TR

Cross-Site Request Forgery

Turkish equivalent: siteler arası istek sahteciliğiDomain: Cybersecurity

A web attack that tricks a user's browser into sending an authenticated state-changing request that the user did not intend.

Technical Context

CSRF relies on ambient credentials such as cookies. Defenses include anti-CSRF tokens, SameSite cookie policy, origin checks, and avoiding state-changing GET requests. Token-based APIs that do not use browser-ambient credentials have a different threat model.

  • SameSite
  • CSRF token
  • cookie
  • Origin header

Updated:

Related concepts

Cybersecurity