Protecting applications from CSRF
The next step in our journey is handling cross-site request forgery (CSRF). It should also be noted that this often also carries the acronym XSRF. If you see these two on the web, they refer to the same issue. So, what is the issue?
Do you remember that suspiciously awkward email that you received that says Click here to claim your $500 prize? That link likely brings you to a malicious website that's controlled by someone that is trying to hack you. They may have placed some links or caused you to do something on their site that sends off a background request to a legitimate website to do something bad. If your application is not protected from CSRF attacks like this, it could be possible for that bad actor to make your users change their passwords without them even knowing!
Thwarting these attacks can be done on both sides. Your users could, of course, take better care not to open the email in their spam box. But you, as a responsible web...
