Cross-Site Request Forgery
Medium · Session · CWE-352
Description
Victim's browser is tricked into sending authenticated requests.
Root cause
State-changing requests rely only on cookies.
Impact
Unwanted actions as the victim.
Detection
Review state-changing endpoints for tokens/SameSite.
Mitigation
CSRF tokens, SameSite cookies, re-auth for sensitive actions.
Secure coding
Use framework CSRF protection; set SameSite=Lax or Strict.
Safe lab example
DVWA CSRF module
Practise related skills in Labs or deepen on Academy library.