Cross-site request forgery (CSRF)

Protect cookie-authenticated actions against CSRF

Make the server distinguish an intended action from a request another site caused the browser to send.

Development · Developers, AppSec engineers

Apply security limits to GraphQL, WebSocket and gRPC operations

Carry authorization and resource budgets past the initial HTTP request into resolvers, messages and long-lived streams.

Development, Maintenance · Developers, Platform engineers and SREs

CSRF lab: Protect an account change from a forged request

An account settings handler trusts the session cookie even when another site causes the request. Repair the request policy and preserve legitimate settings updates.

Cross-site request forgery (CSRF)

Cross-site request forgery happens when a server accepts a state-changing request because it carries the user's session cookie.