Cross-site request forgery

CSRF makes a logged-in user’s browser send a request they never intended. SameSite cookies and anti-forgery tokens close it.

Lesson 2.39m 57sIntermediate9.8k students

Chapters

9:57

0:00Introduction
0:52Project Overview
2:42How CSRF Works
5:15How To Fix CSRF Vulnerabilities

Lesson contentNotes

What this lesson covers

Understand how an ambient credential is abused
Set SameSite cookie attributes correctly
Validate anti-forgery tokens on state-changing requests

This lesson sits in Common Web Vulnerabilities, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.

In this lesson you will

Understand how an ambient credential is abused
Set SameSite cookie attributes correctly
Validate anti-forgery tokens on state-changing requests

Resources

OWASP Top 10 (opens in a new tab)

The official reference for the tools used in this lesson.

Link