Beginner LevelWeb Security & Cyber Defense
How does a Cross-Site Request Forgery (CSRF) attack work and how do Anti-CSRF Tokens prevent it?
❓ Interview Prompt: Explain CSRF attack vectors, implicit browser cookie submission, Anti-CSRF Synchronizer Tokens, and double-submit cookies.
Cross-Site Request Forgery (CSRF) tricks an authenticated victim's browser into submitting unauthorized requests to a target site where the user is currently logged in:
Attack Mechanism:
Browsers automatically include cookies (including session cookies) on cross-site HTTP requests.
•
An attacker website renders an auto-submitting hidden '<form action="https://bank.com/transfer" method="POST">'.
•
When the victim visits the malicious site, the browser sends the form WITH the victim's session cookie!
Defenses:
1
Anti-CSRF Tokens (Synchronizer Token Pattern): Require a unique, cryptographically random token submitted in custom request headers ('X-CSRF-Token'). Attacker sites cannot read cross-origin response tokens due to SOP!
2
'SameSite=Strict' Cookie Flag: Prevents browser from sending session cookies on cross-site requests.
Code Implementation Example
html
<!-- Anti-CSRF Token hidden form field pattern -->
<form action="/api/transfer" method="POST">
<input type="hidden" name="_csrf" value="d9f8a3c2b1e4f7a6..." />
<input type="text" name="amount" value="1000" />
<button type="submit">Transfer Funds</button>
</form>💡Embedding cryptographically random anti-CSRF tokens in HTML forms.
🎯 Interview Key Takeaway
CSRF exploits implicit browser cookie transmission; defend using SameSite cookies and Anti-CSRF tokens in custom headers.
#CSRF#Anti-CSRF Token#Session Security#Beginner
Back to all Web Security & Cyber Defense Questions→