What is CSRF (cross-site request forgery)?

Cross-site request forgery, tracked as CWE-352, is a vulnerability where a web application cannot tell whether a state-changing request was genuinely issued by the user or forged by a malicious site. Browsers automatically include a site's cookies with any request to that site, so if authentication relies only on an automatically sent session cookie, an attacker can craft a request that rides on the victim's existing session.

CSRF targets actions, not data theft: the attacker generally cannot read the response, but they can cause the application to perform an action the logged-in victim is authorized to do.

Say a bank processes transfers via POST /transfer with the parameters to and amount, authenticated solely by the session cookie. An attacker hosts a page containing an auto-submitting form that posts to the bank with to=attacker&amount=1000. When a victim who is logged into the bank visits the attacker's page, their browser submits the form and attaches the bank session cookie automatically. The bank sees a valid session and processes the transfer.

The victim never clicked anything on the bank site; a hidden form, an image tag pointing at a GET endpoint, or background JavaScript is enough. The attack works precisely because the request looks authentic to the server.

Anti-CSRF tokens and SameSite cookies are complementary: tokens are the explicit control, while SameSite provides strong browser-level defense in depth.