Understanding CSRF: Protecting Against Unwanted Requests

What is CSRF?

Cross-Site Request Forgery (CSRF) is a security vulnerability that allows an attacker to trick a user's browser into making unwanted requests to a different site where the user is authenticated. For example, if you're logged into your bank account and visit a malicious site, that site could potentially send a request to transfer money without your knowledge.

How CSRF Works

• Authenticated Session: CSRF takes advantage of the fact that your browser automatically includes cookies for authenticated sessions.
• User Intent: Just because you are logged in does not mean you intended to perform an action. An attacker can exploit this by sending a request that your browser will execute as if you intended it.

CSRF Tokens

• What Are They?: CSRF tokens are unique, unpredictable values generated by the server and included in forms. They ensure that the request is genuine.
• Validation: When a request is received, the server checks for the correct CSRF token before processing the request.

Other Defenses Against CSRF

• SameSite Cookies: Setting cookies with the SameSite attribute prevents browsers from sending them along with cross-site requests.
• Origin/Referer Validation: The server can check the Origin or Referer header to ensure the request is coming from a trusted source.
• Avoid GET for State Changes: GET requests should not be used for actions that change state (like transferring money) to prevent CSRF attacks.

CSRF vs. XSS

• CSRF: Tricks the browser into making requests without user consent.
• XSS (Cross-Site Scripting): Allows attackers to execute scripts in the context of the user’s session.

Key Takeaway

An authenticated session does not guarantee user intent. Always protect state-changing actions with CSRF tokens and implement layered defenses.