CSRF (Cross-Site Request Forgery)

Cross-site request forgery (CSRF) is an attack that tricks a logged-in user's browser into sending an unwanted request to a website they trust, such as changing their email address or transferring money. Because the browser automatically sends the site's cookies, the website thinks the request came from the user.

The attack is usually hidden in a malicious page, email or image link. Defences include anti-CSRF tokens (a secret, random value that must be sent with each form), SameSite cookie settings, checking the Origin header and asking for re-authentication before sensitive actions.