VibeSecurity

Web attacks

What is CSRF (Cross-Site Request Forgery)?

CSRF is an attack where a malicious website makes a logged-in visitor's browser send a request to your app, and the browser attaches their cookies automatically, so your server may treat the forged action as genuine.

If your app identifies users with a cookie, the browser sends that cookie on every request to your domain, even when the request was triggered by a different site. An attacker can build a hidden form on their own page that posts to your app, such as changing an email address or sending a payment. If a victim is logged in, the request looks legitimate.

Apps that store tokens in a header instead of a cookie are less exposed, but many AI-generated apps mix both, or rely on cookies with permissive settings. State-changing routes that accept plain form posts or GET requests are the usual weak spots.

Set session cookies with SameSite Lax or Strict, require a CSRF token or a custom header on every request that changes data, and never change state on a GET request. Framework defaults help, so check that you did not switch them off to silence an error.

Cookie that is harder to abuse cross-site
Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Lax

Related terms

Sources

  1. 1.MDN: CSRF
  2. 2.MDN: HTTP cookies