Lesson 2.310mIntermediate9.8k students

Cross-site request forgery

CSRF makes a logged-in user’s browser send a request they never intended. SameSite cookies and anti-forgery tokens close it.

This lesson sits in Common Web Vulnerabilities, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.

In this lesson you will

  • Understand how an ambient credential is abused
  • Set SameSite cookie attributes correctly
  • Validate anti-forgery tokens on state-changing requests

Resources