CSRF

Cross-Site Request Forgery, commonly known as CSRF, is a web security vulnerability that can have serious consequences for both users and websites. To understand CSRF, we need to explore how websites handle user authentication and how attackers can exploit this process.

How Web Authentication Usually Works

When you log into a website, like your bank's online portal, the site typically gives your browser a special token or ticket. This token is stored as a cookie in your browser. Every time you interact with the bank's website after logging in, your browser automatically sends this token along with your request. This process allows the website to recognize you as an authenticated user without asking you to log in for every action you take.

The CSRF Vulnerability

The problem arises because many websites automatically trust any request that comes with a valid authentication token, without verifying if the user actually intended to make that request. This trust is what CSRF attacks exploit.

How a CSRF Attack Works

1. Setting the Stage. Imagine you're logged into your bank's website in one browser tab.
2. The Trap. An attacker creates a malicious website or sends you an email with a hidden form or a disguised link.
3. Springing the Trap. When you visit the malicious site or click the link, it automatically sends a request to your bank's website.
4. The Deception. Your browser, still holding the authentication token from your legitimate login, automatically includes this token with the request.
5. The Consequences. The bank's website receives a seemingly legitimate request from an authenticated user (you) and processes it, potentially transferring money or changing your password.

Example Scenario

Let's say your bank allows you to transfer money using a simple GET request like this: www.yourbank.com/transfer?to=account123&amount=1000

A CSRF attack might look like this: