CSRF
Cross-site request forgery
Another site makes the victim’s browser send an authenticated request the user did not intend. Defenses depend on how credentials are sent, the request type and the application context.
- Also called
- XSRF
- Fix it in your stack
- Cross-site request forgery (CSRF) fix cards (7 stacks) · CWE-352 page
- Defined in
- MITRE CWE-352
- Identifiers
- CWE-352: Cross-site request forgery (CSRF)
Covered in
Protect cookie-authenticated actions against CSRF
Make the server distinguish an intended action from a request another site caused the browser to send.
Preserve framework security controls across the request lifecycle
Trace middleware, persistence and rendering so custom code does not bypass the protections supplied by the framework.
Defend OAuth and OIDC against redirect and token attacks
Apply RFC 9700 and RFC 10017: exact redirect matching, PKCE with downgrade protection, state and iss binding, refresh-token rotation, sender-constrained tokens, and a backend-for-frontend so browser tokens cannot be stolen.
Configure CORS and CSP around the browser capabilities you need
Control who can read API responses and which resources a page may execute without confusing either control with authorization.
Session management: cookies, timeouts, rotation and revocation
Model authentication as transitions in server authority, set session cookies and timeouts to current NIST and OWASP values, and verify fixation prevention, expiry, reauthentication, revocation and stolen-cookie defenses.
OAuth 2.0 and OpenID Connect login: authorization code with PKCE
Implement OAuth 2.0 and OpenID Connect login with the authorization code flow and PKCE, keep each transaction bound to its browser, and block redirect, mix-up, code-injection and token-theft attacks.
All 7 pages that cover CSRF in the library
Practice: CSRF lab: Protect an account change from a forged request · CORS policy lab: Grant CORS to the right origins only · CSP builder lab: Build a strict Content-Security-Policy · OAuth redirect and PKCE lab: Match redirect URIs and verify PKCE