Cross-Site Request Forgery (CSRF)

Forces authenticated web users to submit unwanted HTTP requests using their active session.

Core Principles & Analysis

• Abuses the browser's automatic inclusion of session cookies.
• Can silently change passwords or authorize fund transfers.
• Prevented with anti-CSRF tokens and SameSite cookie attributes.

Specifications & Metrics

• CVE: CWE-352
• IMPACT: Medium-High