Lesson 2.3
Cross-site request forgery
CSRF makes a logged-in user’s browser send a request they never intended. SameSite cookies and anti-forgery tokens close it.
9mIntermediate9,842 students
Sign in to watch this lesson
Browsing is free. Create an account to play videos and track your progress.
Overview
CSRF makes a logged-in user’s browser send a request they never intended. SameSite cookies and anti-forgery tokens close it.
What this lesson covers
- Understand how an ambient credential is abused
- Set SameSite cookie attributes correctly
- Validate anti-forgery tokens on state-changing requests
This lesson sits in Common Web Vulnerabilities, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.
In this lesson you will:
- Understand how an ambient credential is abused
- Set SameSite cookie attributes correctly
- Validate anti-forgery tokens on state-changing requests