Login Register
Lesson 1 · Free preview · 13 min

How CSRF works

The three preconditions, and why the session cookie is the whole problem.

On this page
Three preconditions The attack What CSRF is not

CSRF abuses the fact that browsers attach cookies to requests automatically, regardless of who initiated them.

Three preconditions

  1. A relevant action — something worth doing (change email, transfer funds, add an admin).
  2. Cookie-only session handling — the request is authorised purely by the session cookie, which the browser sends for you.
  3. No unpredictable parameters — the attacker can determine or guess every value the request needs.

The attack

The attacker hosts a page that issues the request. When a logged-in victim visits it, the browser attaches their session cookie and the server cannot tell it apart from a genuine click.

<form action="https://bank.example/transfer" method="POST">
  <input type="hidden" name="to" value="attacker">
  <input type="hidden" name="amount" value="1000">
</form>
<script>document.forms[0].submit()</script>

What CSRF is not

It does not let the attacker read the response (same-origin policy stops that). It is fire-and-forget: useful for actions, not data theft. For reading, you need XSS or a CORS misconfig.

Next