Cross-site request forgery

CSRF makes a logged-in user’s browser send a request they never intended. SameSite cookies and anti-forgery tokens close it.

10m
Intermediate

Video thumbnail for Cross-site request forgery

Video by Web Dev Simplified · YouTube

Check your understanding

3 questions. Unlocks when you finish the video.

Overview

What this lesson covers

Understand how an ambient credential is abused
Set SameSite cookie attributes correctly
Validate anti-forgery tokens on state-changing requests

This lesson sits in Common Web Vulnerabilities, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.

In this lesson you will:

Understand how an ambient credential is abused
Set SameSite cookie attributes correctly
Validate anti-forgery tokens on state-changing requests

Resources

OWASP Top 10The official reference for the tools used in this lesson.