What is CSRF attack? Simplified for Beginners

You’re logged into your bank account. Later, you click a link in an email. Unknowingly, that link secretly triggers a request to transfer money to a hacker’s account – all because your browser is still logged in.

This is CSRF (Cross-Site Request Forgery), a sneaky attack that exploits your logged-in sessions. Let’s break down how it works and how to stop it.

What is CSRF?

CSRF is a security flaw where attackers trick your browser into performing unwanted actions on a website you’re logged into. For example:

• Sending money from your bank account.
• Changing your email password.
• Posting content on your social media.

The attacker doesn’t steal your password. Instead, they abuse the trust between your browser and the website.

How CSRF Works:

Let’s break down a real-world CSRF attack:

1️⃣ Step 1: The Setup

• You log into trusted-site.com (bank, social media, etc.).
• The site saves a session cookie in your browser.

2️⃣ Step 2: The Trap

• You visit a forum, ad, or email with hidden malicious code.

<img src="https://trusted-site.com/transfer?amount=5000&to=attacker">

3️⃣ Step 3: The Attack

• Your browser sends the request with your saved cookies (because you’re logged in).
• The server thinks you initiated the transfer.

4️⃣ Step 4: Profit

• The attacker’s account gets $5,000. You’re left confused.

Real-World CSRF Disasters

• MySpace (2005): Hackers used CSRF to auto-add a “Samy” profile to millions of users’ friends lists. The worm spread in hours.
• Netflix (2006): Attackers could add DVDs to users’ queues without consent.
• YouTube (2008): CSRF flaws let attackers mark all videos as “liked” or hijack accounts.

How to Prevent CSRF: 5 Simple Steps

🛡️ 1. CSRF Tokens

• What: Generate a unique, random token for every user session.
• How: Embed it in forms, headers, or meta tags. Validate it server-side.
• Why it works: Attackers can’t guess or steal the token.

<input type="hidden" name="csrfmiddlewaretoken" value="a1B3cD5eF7gH9iJk">  

🍪 2. Enable SameSite Cookies

• Set cookies with SameSite=Lax or Strict to block cross-site requests.
• Lax: Allows safe GET requests (e.g., links from Google).
• Strict: Cookies are only sent if the user is directly on your site.

Set-Cookie: auth=xyz; SameSite=Strict; Secure; HttpOnly

💡3. Use POST for Critical Actions

• Never use GET requests for actions like transfers or password changes.
• GET requests are riskier because they can be triggered by links or images.

🔍 3. Validate Origin and Referrer Headers

• Check the Origin or Referer headers to ensure requests come from your domain.
• But: Some privacy tools block these headers, so use this as a supplement, not a sole defense.

💡 4. Use POST for Sensitive Actions

• GET requests are easier to exploit (e.g., via <img> tags).
• Force state-changing actions (transfers, password changes) to use POST, PUT, or DELETE.

🛠️ 5. Double Submit Cookies

• Send the CSRF token in two places: a cookie and a request parameter.
• The server compares both values to confirm legitimacy.

🚫 6. Custom Headers for APIs

• Require custom headers like X-Requested-With for AJAX requests.
• Browsers block cross-origin scripts from adding custom headers.

⏳ 7. Shorten Session Timeouts

• Reduce the window for attacks by expiring sessions quickly.
• Bonus: Add re-authentication for critical actions (e.g., transferring money).

Why CSRF Still Matters in 2024

Even with modern security practices, CSRF vulnerabilities persist because:

• Developers forget to enable protections.
• Legacy systems ignore secure cookie settings.
• APIs use cookie-based authentication without tokens.

Did You Know? In 2023, 1 in 20 websites tested had CSRF flaws.

CSRF vs. XSS: What’s the Difference?

• CSRF: Tricks a user into performing an action (e.g., transferring money).
• XSS: Injects malicious code to steal data (e.g., session cookies).
• Key Point: XSS can bypass CSRF protections. Protect against both!

Quick CSRF Checklist for Developers

• ✅ Add CSRF tokens to all forms and state-changing requests.
• ✅ Set cookies with SameSite=Strict or Lax.
• ✅ Use POST/PUT/DELETE for sensitive actions (never GET).
• ✅ Perform security testing of your application

Final Thoughts

CSRF attacks exploit trust between users and websites. By adding tokens, securing cookies, and using modern frameworks, you can block these attacks.

Need Help? Explore These Resources:

• OWASP CSRF Guide
• Google’s SameSite Cookie Guide
• Vulnerability and Penetration Testing
• CSRF Testing with Burp Suite

Engage With Us!

Have questions about CSRF? Drop them in the comments! 👇