# What is Cross-Site Request Forgery (CSRF)?

> Cross-site request forgery (CSRF) is a web weakness in which an attacker causes a user’s browser or client-side code to send an unintended request to an application that trusts the user’s existing authenticated context.

- Canonical URL: https://yellowcube.eu/glossary/cross-site-request-forgery/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

The application accepts the request because credentials such as cookies accompany it automatically, without adequately confirming that the user intended the action. The impact is limited by the user’s privileges and the vulnerable operation.

Defenses should distinguish intentional, same-application actions from requests initiated or influenced elsewhere. Framework-provided protection is preferable when its scope and configuration are understood, and sensitive actions may also need explicit reauthentication or confirmation.

### Key points

- **Request integrity:** Use unpredictable anti-CSRF tokens bound to the user’s session and validate them server-side on state-changing requests, or use another framework-supported pattern with equivalent properties.
- **Browser signals:** Configure SameSite cookies appropriately and validate Origin, Fetch Metadata, or expected custom headers where suitable; treat these as layered signals with documented compatibility and proxy behavior.
- **Workflow design:** Do not allow nominally read-only request methods to change state, require current authorization for every action, limit session privileges and duration, and add step-up checks for high-consequence operations.
- **Important limitation:** SameSite cookies or token presence alone does not guarantee protection. Tokens can be leaked, predictable, or incorrectly bound, and cross-site scripting (XSS) within the trusted application can defeat many CSRF defenses.

### Related terms

[Cross-site scripting (XSS)](<https://yellowcube.eu/glossary/cross-site-scripting/>) · [Web application security](<https://yellowcube.eu/glossary/web-application-security/>) · [Authentication](<https://yellowcube.eu/glossary/authentication/>) · [Authorization](<https://yellowcube.eu/glossary/authorization/>) · [Application programming interface (API) security](<https://yellowcube.eu/glossary/application-programming-interface-security/>)

### Sources

[OWASP Cross-Site Request Forgery Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html) · [MITRE CWE-352: Cross-Site Request Forgery](https://cwe.mitre.org/data/definitions/352.html)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.