Codecademy Logo

Preventing Cross-Site Request Forgery (CSRF) Attacks

Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery is a serious vulnerability that results from poor session management. If the requests sent by an application aren’t unique, it’s possible for an attacker to craft a special request and send that to a user. If the user interacts with the crafted request, and sessions aren’t handled properly, an attacker may be able to assume the session identity of that user and carry out requests on their behalf.

In many cases of CSRF, a malicious actor crafts a URL embedded with a request like so:
http://bank.com/send?recipient=Stranger&amount=2000

Preventing CSRF Attacks

Cross-Site Request Forgery (CSRF) attacks are relatively easy to mitigate. One of the simplest ways to accomplish this is through the use of CSRF tokens, which are unique values dynamically generated by a server-side application and sent to the client. Since these values are unique for every request, and constantly changing, it is nearly impossible for an attacker to pre-create the URLs/requests for an attack.

A user is able to send a request through to a web application after a valid check on a CSRF token. An attacker who is attempting to make a CSRF attack via the user does not pass the token check, and fails to force the user through the same request.
0