Cross-Site Request Forgery (CSRF)

What Is Broken and Why

CSRF exploits the browser's automatic inclusion of credentials (cookies, HTTP Basic auth) with every request to a given origin. An attacker-controlled page on a different origin can cause the victim's browser to send authenticated requests to the target application. Since the browser automatically attaches the session cookie, the server cannot distinguish the forged request from a legitimate one — unless it validates a secret token that only the legitimate page would know. Absent CSRF tokens, SameSite=Strict/Lax cookie attributes, or origin validation, any state-changing operation is potentially exploitable.

Key Signals

• State-changing requests (account settings, password change, fund transfer, email change) without a CSRF token
• CSRF token present but predictable, static, or not validated server-side
• Cookie lacks SameSite=Strict or SameSite=Lax attribute
• Content-Type: application/json endpoints that also accept text/plain (allows form-based CSRF)
• API endpoints not verifying Origin or Referer headers
• WebSocket handshakes without origin validation