CSRF

Cross-Site Request Forgery

Attack tricking a logged-in user's browser into making unwanted requests.

When you'd see it: Web application security reviews and penetration tests. The hidden CSRF token in a form exists to prevent it.

Why it matters: CSRF tricks a logged-in user's browser into making a request they did not intend, like changing their email or moving money. It abuses the trust a site places in an already-authenticated session.

Common mistakes: Confusing CSRF with XSS. XSS injects malicious code into a page, CSRF rides an existing logged-in session. The defenses are different.