How does a cross-site request forgery (CSRF) attack work?

Question

Accepted Answer

A malicious page makes the victim's browser send an authenticated request to a target site — CSRF abuses the browser automatically attaching credentials, causing an unwanted authenticated action. It does not read the cookie (SOP/HttpOnly prevent that — that would be theft), it does not inject script (that is XSS), and it does not sit in the network path (that is MITM).

Answer

A malicious page reads the victim's session cookie and replays it against the target site

Answer

A malicious page injects a script into the target site that runs in the victim's session

Answer

A malicious page intercepts the victim's request and rewrites it before it reaches the site

How does a cross-site request forgery (CSRF) attack work?

Why this is the answer

More Web Security flashcards