Definition
An attack that tricks authenticated users into performing unintended actions on a web application they're logged into.
In Depth
CSRF exploits the trust a site has in a user's browser. If a user is logged into their bank, a malicious page could submit a hidden form to transfer money. Prevention includes CSRF tokens (unique per session/request), SameSite cookie attributes, and checking the Origin/Referer header.
Example Usage
Django's built-in CSRF middleware automatically generates and validates CSRF tokens on all POST requests.
Business Context
CSRF protection is table stakes for any web application handling sensitive actions, and Django and most modern frameworks include it by default.
Related Terms
API Key
A unique identifier used to authenticate and authorize API requests, typically passed as a header or...
Cross-Origin Resource Sharing
A browser security mechanism that controls which domains can make requests to your API, preventing u...
Cross-Site Scripting
A web security vulnerability that allows attackers to inject malicious scripts into web pages viewed...
Django
A high-level Python web framework that provides an ORM, admin interface, authentication, and 'batter...
Multi-Factor Authentication
A security method requiring two or more verification factors (password + phone code, biometric, hard...
Also Known As
Tags
Quick Info
Need help implementing this in your business?
Get Started