Cross-Site Request Forgery (CSRF)

Summary

Tricking a logged-in user's browser into submitting an unwanted request to a site they're authenticated to — exploiting the browser's automatic inclusion of session cookies.

• 1Learn how a CSRF attack works step by step, from a crafted malicious link or form.
• 2Understand why anti-CSRF tokens (unique per session/request) are the standard defense.
• 3Research the SameSite cookie attribute as a modern, complementary defense.