Cross-Site Request Forgery (CSRF)
mediumWhat is CSRF?
CSRF tricks an authenticated user's browser into sending unintended requests to a web application, executing actions without their knowledge.
How it works
An attacker creates a malicious page containing a form or script that sends a request to the target application. When an authenticated user visits this page, their browser automatically includes session cookies with the forged request.
Impact
Unauthorised fund transfers, email address changes, password resets, privilege escalation, and any state-changing action the victim is authorised to perform.
ShieldReport checks for missing CSRF tokens in forms, missing SameSite cookie attributes, and absence of Origin/Referer validation.
How to fix it
Implement anti-CSRF tokens (synchronizer pattern). Set SameSite=Strict or Lax on session cookies. Validate Origin and Referer headers on state-changing requests.
Tags
Is your site vulnerable to CSRF?
Run a free scan to find out in under 2 minutes.
Scan Now