Suggest an editImprove this articleRefine the answer for “What is CSRF?”. Your changes go to moderation before they’re published.Approval requiredContentWhat you’re changing🇺🇸EN🇺🇦UAPreviewTitle (EN)Short answer (EN)**CSRF (Cross-Site Request Forgery)** is an attack in which the attacker makes a user's browser perform an action on a site without their knowledge, using an already authorized session. **Key point:** a CSRF token is the key defense against this attack.Shown above the full answer for quick recall.Answer (EN)Image**CSRF (Cross-Site Request Forgery)** is an attack in which **the attacker makes a user's browser perform an action on a site without their knowledge**, using an already **authorized session**. In simple terms: *the site thinks the user is performing the action, but it was actually triggered by the attacker.* --- ## How CSRF works in simple terms 1. The user **is logged in to a site** (for example, online banking) 2. The session is active (cookies are stored in the browser) 3. The user visits a **malicious site** 4. That site quietly sends a request to the trusted site 5. The browser automatically attaches the cookies 6. The server performs the action, thinking it is the user The core problem: **the site's trust in the user's browser**. --- ## What a CSRF attack can do - change a password; - change an email address; - transfer money; - change account settings; - perform any action without confirmation. CSRF **does not steal data directly**, it forces actions to be performed. --- ## A CSRF example in simple terms You: - are logged in to a bank, - open another site, - and that site "presses the button" in the bank for you. --- ## How CSRF differs from XSS Important for the interview. | Criterion | CSRF | XSS | |---|---|---| | Where the code runs | On the attacker's side | In the victim's browser | | Uses the victim's session | Yes | Yes | | Script injection | No | Yes | | Main goal | Perform an action | Steal data | --- ## Which security properties are violated - **Integrity** - unauthorized data changes; - sometimes **Confidentiality** - indirectly. --- ## How to defend against CSRF ### Main defense measures: - CSRF tokens (the main one); - checking Origin / Referer; - SameSite cookies; - confirming critical actions; - re-authentication. **A CSRF token is the key defense**.For the reviewerNote to the moderator (optional)Visible only to the moderator. Helps review go faster.