What Is Cross-Site Request Forgery?
Show notes
Cross-site request forgery occurs when an attacker causes a logged-in user’s browser to submit an unwanted request to a trusted application. Certification exams may describe a victim visiting a malicious page while already authenticated to another service and ask candidates to identify why the second application accepts the request. Because the browser automatically includes session cookies, the application may believe the request was intentionally submitted by the user. An attacker could attempt to change an email address, transfer funds, modify settings, or perform another authorized action. Defenses include anti-forgery tokens, same-site cookie settings, origin validation, reauthentication for sensitive actions, and avoiding state-changing operations through simple web requests. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with. And dont forget Cyberauthor.me for the companion study guide and flash cards!