What cross-site request forgery is
Cross-site request forgery, often abbreviated CSRF, is a web security vulnerability in which an attacker tricks a user's browser into sending an unwanted request to a website where the user is already logged in. Because the user is authenticated, the site may treat the forged request as a legitimate action, carrying it out without the user intending it. The attack exploits the trust a site has in the user's browser.
How the attack works
In a CSRF attack, the attacker gets the victim's browser to make a request to a target site while the victim is logged in there. This can happen if the victim visits a malicious page that quietly triggers the request. The browser automatically includes the user's existing authentication, so the target site sees an apparently valid request and may perform the requested action.
Exploiting existing sessions
The key to CSRF is that it takes advantage of a user's existing authenticated session. The attacker does not need the user's credentials; they only need the user to be logged in and to trigger the request through the user's browser. Because the browser sends along the authentication automatically, the forged request can act with the user's privileges on the target site.
What an attacker can achieve
Through CSRF, an attacker can cause the victim to perform actions they did not intend on a site where they are authenticated, such as changing settings or submitting data. The user may be entirely unaware. This makes CSRF a serious concern, because it can lead to unwanted changes to a user's account or data carried out under their own identity.
Preventing CSRF
A common defense against cross-site request forgery is to require a secret token with sensitive requests that an attacker cannot predict or obtain. Because a forged request would lack the correct token, the site can reject it. This and related measures help ensure that requests genuinely come from the user's own interaction with the site rather than from an attacker's forgery.
Why it matters
Cross-site request forgery is an important web security vulnerability to understand. Knowing what CSRF is - tricking a logged-in user's browser into making an unwanted request - clarifies how attackers can abuse trust and sessions. For anyone interested in web security, it is a valuable concept to understand.
Related on Skillo
See also: What is a cookie? Explained, What is cross-site scripting (XSS)? Explained.
Sources
Published date reflects the original event date (2026-04-21). This article is original Skillo editorial written from the sources above; facts were verified in September 2026.
Leave a Reply