Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

Find a vulnerability guide

65 deep-dives · 27 topics

Follow via RSS

Posts tagged #csrf

2 posts

All topics Clear tag filter

Client-side & redirectsOverview <form method="post" action="https://app.example/account/email">

Cross-Site Request Forgery7 min read

Cross-Site Request Forgery, Explained: From a Hidden Form to an Account Takeover

A signed-in browser attaches its session cookie to requests that another site starts. Here is how cross-site request forgery turns that into actions the user never chose, why SameSite cookies alone do not settle it, and how tokens and origin checks close the gap.

Client-side & redirects new WebSocket('wss://app.example/ws')

Cross-Site Request Forgery6 min read

Cross-Site WebSocket Hijacking: CSRF on a Connection That Talks Back

A WebSocket handshake carries the user's cookies but faces no CORS check. When the server skips Origin validation, any page the user visits can open an authenticated socket, read what it pushes and send commands back. Here is how to test for it and how to close it.