Cross-site request forgery (CSRF)

Meaning

Cross-site request forgery (CSRF) is an attack that tricks a logged-in user's browser into sending an unwanted request to a site, such as changing an email address, because the browser attaches the user's cookies automatically. The usual defence is a secret, unpredictable token placed in each form and checked on submission, so a request without the right token is refused. Setting the SameSite cookie attribute and using POST for state-changing actions add further protection. It differs from XSS, which runs attacker script in the browser. See also: XSS, Session, and the guide PHP Security Basics: Validation, Prepared Statements and More.