What is CSRF (Cross-Site Request Forgery) and How to Prevent It?
CSRF is the execution of unwanted operations on a secure site that the user is logged in to (authenticated) without his knowledge. This attack does not target the login fields, but the trust between the browser and the site.
How Does the Attack Happen?
You log into your online banking portal (your active session cookies are now stored in your browser).
While keeping that tab open, you visit a malicious website in another tab.
The malicious site triggers a hidden background request directed at your bank, such as: transfer?amount=1000&to=attacker.
Because browsers automatically attach valid session cookies to requests destined for that origin, the bank processes the request, thinking you authorized it.
Potential Impact
For users: Changing the password, transferring money from the profile or making unauthorized purchases.
For administrators: The attacker adds a new admin to the site via the admin browser and takes over the entire system.
Proven Mitigation Strategies
- Anti-CSRF Tokens (Gold Standard) The server generates a unique secret token for each session or form that is impossible to guess. When a form is submitted, the server checks this token. Since a malicious external site cannot read this secret token, any fake requests it sends are immediately rejected by the server.
- SameSite Kuti Attribute This is browser-level protection. By setting SameSite=Lax or Strict to the boxes, you are telling the browser: "Send this box only when the user is directly on our site, do not include this box in requests from external sites."
- Re-Authentication for Critical Operations Require the user to re-enter their current password or perform 2FA (MFA) confirmation at critical moments such as changing a password, transferring money, or updating an email. A hacker cannot fill out these forms in the background.
Conclusion
Relying on valid boxes alone is not enough for a secure web application; It is imperative to verify that each state-changing request is made by a real user with Anti-CSRF tokens.
