Skip to content
SelfSec
Join the launch listLaunch list
SelfSec
Vulnerability field guide

Cross-Site Request Forgery

A signed-in browser attaches its session cookie to requests that another site starts. Here is how cross-site request forgery turns that into actions the user never chose, why SameSite cookies alone do not settle it, and how tokens and origin checks close the gap.

2 articles 13 min total Overview to advanced techniques

Start with the overview

Cross-Site Request Forgery7 min read

Cross-Site Request Forgery, Explained: From a Hidden Form to an Account Takeover

A signed-in browser attaches its session cookie to requests that another site starts. Here is how cross-site request forgery turns that into actions the user never chose, why SameSite cookies alone do not settle it, and how tokens and origin checks close the gap.

Read the overview

Cross-Site Request Forgery techniques

1 focused deep-dive
  1. 02 WebSocket HijackingCross-Site WebSocket Hijacking: CSRF on a Connection That Talks Back 6 min