juniorWeb Security
What is CSRF and how does it work?
Updated May 6, 2026
Short answer
CSRF tricks a user’s browser into making unintended requests to a trusted site.
Deep explanation
CSRF exploits authenticated sessions by sending malicious requests using the victim's cookies. Servers must validate request origin or use tokens.
Real-world example
Bank transfer triggered without user consent.
Common mistakes
- Relying only on cookies for authentication.
Follow-up questions
- How do CSRF tokens work?
- Does CORS prevent CSRF?