Cross-Site Request Forgery
Also known as: CSRF
Cross-Site Request Forgery (CSRF) is an attack that tricks a logged-in user's browser into submitting an unwanted, authenticated request to a site they're already logged into — transferring money, changing an email address — without the user's knowledge, by exploiting the browser automatically attaching valid session cookies to the request.
The attack relies entirely on the victim already having an active, authenticated session — a malicious page or email can trigger a request to a legitimate site the victim is logged into, and the browser dutifully attaches the victim's real session cookie, making the forged request look completely legitimate to the server.
The standard defense is a CSRF token: a unique, unpredictable value the server requires on state-changing requests, which an attacker's forged request has no way of knowing or including. Testing for it means confirming state-changing endpoints reject requests missing a valid CSRF token, not just requests missing a valid session.
