CSRF

Meaning

CSRF, or cross-site request forgery, is an attack in which a malicious page makes the victim's browser send an authenticated request to another site. It works because browsers attach cookies automatically, so the target site sees a valid session. MDN lists CSRF tokens, checking Fetch metadata headers such as Sec-Fetch-Site, and the SameSite attribute as defences. State-changing actions must never happen on GET, and sensitive steps can ask the user to confirm. It is a different problem from XSS. See also: SameSite, XSS, Cookie header, the guide "Cookies, CSRF, XSS and Privacy Consent Basics".