Request forgery
Cross-Site Request Forgery (CSRF), is a web security vulnerability that occurs when an attacker fools the browser into doing an unwanted action on a third-party trusted site. The user is authenticated on the third-party site, and the CSRF attack exploits that authentication. One of the most infamous CSRF attacks occurred in 2008 and targeted the WordPress blogging application. The attack is known as the “Samy Worm” because Samy Kamkar created it.
Here’s an overview of CSRF and preventive measures:
- CSRF attack scenario:
- An attacker tricks a user into loading a page that contains a malicious request
- The malicious request is crafted to act on a target site where the user is authenticated (e.g., changing account settings or making a purchase)
- Since the user is authenticated on the target site, the browser includes the user’s session cookie in the request, making it appear legitimate to the target site
- The target site unknowingly processes...
