Cross-Site Request Forgery (CSRF) is an attack that tricks the victim into loading a page that contains a
malicious request. It is malicious in the sense that it inherits the identity and privileges of the victim
perform an undesired function on the victim's behalf, like change the victim's e-mail address, home address,
password, or purchase something. CSRF attacks generally target functions that cause a state change on the
but can also be used to access sensitive data.
For most sites, browsers will automatically include with such requests any credentials associated with the
such as the user's session cookie, basic auth credentials, IP address, Windows domain credentials, etc.
if the user is currently authenticated to the site, the site will have no way to distinguish this from a
legitimate user request.
In this way, the attacker can make the victim perform actions that they didn't intend to, such as logout,
item, change account information, retrieve account information, or any other function provided by the
Sometimes, it is possible to store the CSRF attack on the vulnerable site itself. Such vulnerabilities are
Stored CSRF flaws. This can be accomplished by simply storing an IMG or IFRAME tag in a field that accepts
or by a more complex cross-site scripting attack. If the attack can store a CSRF attack in the site, the
of the attack is amplified. In particular, the likelihood is increased because the victim is more likely to
the page containing the attack than some random page on the Internet. The likelihood is also increased
victim is sure to be authenticated to the site already.
Synonyms: CSRF attacks are also known by a number of other names, including XSRF, "Sea Surf", Session
Cross-Site Reference Forgery, Hostile Linking. Microsoft refers to this type of attack as a One-Click attack
their threat modeling process and many places in their online documentation.