WebSecureViz

Interactive Security Learning

Catalog
Web Security Visualizer
Step 420–25 minutes

Cross-Site Request Forgery (CSRF)

CSRF is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated.

VISUALIZATION: CSRF ATTACK
Evil.comUser is not here yet
Bank.com
Valid Session
User is logged into Bank.com (Session Cookie is stored in browser).

Mastery Goals

Understand cookie-based authentication risks and CSRF defenses

  • cookie attachment behavior
  • forged requests
  • CSRF tokens
  • SameSite cookies

Ready to move on?

Mark this section as complete to track your progress through the curriculum.

Next Topic