Cross-site request forgery
Also known as CSRF
Tricking an authenticated user's browser into submitting an action they did not intend.
Because the browser attaches session cookies automatically, a request triggered from a malicious page arrives at the target application looking entirely legitimate.
Anti-forgery tokens and same-site cookie settings address it, and modern frameworks generally include the protection by default, which has made it far less common than it was.
Where this comes up
Cross-site request forgery sits inside our penetration testing work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.
Related terms
OWASP Top 10 A widely referenced list of the most critical web application security risks, updated periodically. Web application penetration test Testing focused on a specific application, its logic, authentication, and handling of user input. Token theft Stealing the session token issued after a successful login, letting an attacker resume the session without credentials or MFA.